Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 14:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
  • Size 5.4MB
  • Sample260930-saavxsaf36
  • SHA256 0f5f320791985fa9ba49ac1b2a196cff430576a66dd6e81d27b3c0537ecb7a70
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6132
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6008.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3528
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a646D.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5164
          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3600
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6845.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3544
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5048
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B72.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4488
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4648
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EDD.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:952
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2296
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7267.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4732
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1556
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7814.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4228
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5368
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82D2.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4316
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2736
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B5C.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3320
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4476
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E78.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3640
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1144
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3E7.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4452
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3296
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6E5.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1264
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5996
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2244
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2100
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB721.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4256
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2220
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4392
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5176
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCCE.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3428
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3880
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF3F.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1952
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1444
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC23D.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1548
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1392
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC51B.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4480
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1000
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC819.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5468
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4016
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAF7.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4900
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1976
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDA7.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2036
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3620
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE91.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3108
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4968
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF6C.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1820
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5040
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD056.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5276
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1216
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD140.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3800
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5084
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD21B.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1156
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3572
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD325.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5772
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1884
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD41F.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5452
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3964
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD509.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:6036
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:6088
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD622.bat
                                                                                                                              62⤵
                                                                                                                                PID:1480
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:3452
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD72C.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:4908
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4832
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD807.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3900
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2092
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8C2.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:3196
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4348
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9CC.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:4856
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2940
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD6.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:6012
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:5708
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD0.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:1748
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:6084
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1140
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4876
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:2720
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:968
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF1B.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4924
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:5672
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFE6.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:3968
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:5856
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                      PID:4996
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3324
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1AC.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:432
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4408
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2B5.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2344
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5376
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE380.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:1500
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3840
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46B.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:3224
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE555.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:476
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE630.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1096
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE70B.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:3156
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7F5.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3436
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:6096
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8B0.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:5968
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:2844
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE99B.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                        PID:780
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:2860
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA76.bat
                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:5896
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:5268
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB70.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC6A.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                        PID:5804
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:2268
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED73.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                              PID:1692
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE7D.bat
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                    PID:4660
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3448
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF77.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:564
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF042.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5356
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF14C.bat
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:5404
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:764
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF236.bat
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                      PID:1388
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:1396
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF330.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3116
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF40B.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:4156
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF534.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF64D.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:4344
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF756.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                  PID:1932
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:3980
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF860.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF93B.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                              PID:5624
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA35.bat
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:1496
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB2F.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                            PID:2232
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                                PID:2108
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC0A.bat
                                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4000
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD04.bat
                                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:1348
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:1276
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDFE.bat
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5196
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:628
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEE8.bat
                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:3136
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4960
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFF2.bat
                                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:2764
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC.bat
                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:204
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:5132
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C6.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:5796
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a272.bat
                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:3716
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32E.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:3864
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:2212
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a495.bat
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a551.bat
                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a939.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:576
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1260.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a133B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a156E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1648.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1733.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a181D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1ED4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a205A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2135.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2200.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2368.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2442.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a259A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2627.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a279E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a284A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2915.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FEB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3097.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3123.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a327B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3337.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a347F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a354A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3682.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a372E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3876.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3941.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2884
                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:3480
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:3840

                                                                                                                                                                                                                Network

                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                      Windows Command Shell

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1059.003

                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1016

                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                      1
                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                      $$a6008.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6008.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 d946a2346c556e24dd9cc428d09856411937da0af71da851b6c6dddc37929581
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a646D.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a646D.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 99c01b88e7624d5319a9c8dc36c8dc265c521cd01ea15757d2a28a842455ef7d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a6845.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6845.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 24b9856ab323b42b2f7a08c9bebeacd137468ba3af039f609a1898e905e544d1
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a6B72.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6B72.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 cd82f1998331595e85d68bb447e10c3e0bc01f0a7eb3dfeaee116abbd3b981fb
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a6EDD.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6EDD.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 a9ddadd71145fe7acb878b4d71a2f5ef6e09c7e1bbf9047fa2bc58d39344cdf4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a7267.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7267.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 2ea99d04bf98b4d388b633daf071b1a097e0257eea0b884f5f05b35c7531c972
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a7814.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7814.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 ee0d1d1381cf7ebe1b0b240e398cdc3fd0332f7093956b7699a19defc9288f7b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a82D2.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a82D2.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 d1b3a2f616dc6693079f6a358016045a90149dfee3d3ee9c5672cf18c187cb60
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a9B5C.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9B5C.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 77d57c5be51ac250a1f6e0ec267beab7d0a849982a0270939fbe068c61dfc264
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a9E78.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9E78.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 c53d4dfc8295e9cf900d13bb5e1d94e27e9ceb7ec68d9d841b2d2ba65e396cf1
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aA3E7.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA3E7.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 dbf52eb92b2c40ca0f325cb807b2c807383818f6e0d22e422f32fd8a6a7b6911
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aA6E5.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA6E5.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 79b469eb2992d7f0f12c7fc0add79d59c05f1e2df6b7e77946e4cb11dda99e74
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aAAFC.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 1f369eaab56e738735202ac27825d05047b89fb6c42b7491046c5784875ce412
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aB721.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB721.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 0be5ebcb8e35dc1ddba8ea8a20c1f9786a7a73804b078f0607360eae6d0dd30c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aB953.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 0e99506997809e4d4a27de49e1b40c07dfff834f8ff43d76de4f047cbde3f71d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aBCCE.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBCCE.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 46d95dfef9b867e2e90fa3c1ddb9cedb6d1def3357fb74a30e603ccbee3c4136
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aBF3F.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBF3F.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 32f344af0f5cbb187563be48d7833a225f14957ba8b4d3272dd521b9982778f9
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aC23D.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC23D.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 f95ec91f2489f2ba38dc91a57e31378f85ba82dcac5a1cdbf981316b4031fb88
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aC51B.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC51B.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 ad25d260b3601b8e425de9008174e4c82aa2229b32562936c25a9dc1d7be6088
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aC819.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC819.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 62cbe20c23a2724bbafb758a61ca0031c662b9add63e1d3d4ab64dcafa1da3af
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aCAF7.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aCAF7.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 02408132cebb452d0aefaa4addefb390a5cb8903bcdbf5fcbccf91288106e8d0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                      • SHA256 c503b499bfff49271ebdd5c3fc45bb707ec2aae0dbeee6f1ec599bfe645b5b61
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                      • SHA256 273fcd7cccbd4ce8fc4be3ceb33875f40eec61a74220c004329fc9c639371da4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                                                      • SHA256 4fac0ddb10bd33137e3b428f52f480e6f48712dbe5f44ab614c53bf55001ca3d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                      • SHA256 6f812bab5ae049a3c098d32f3fb7e5893f56cc2f961fbdcb2bf61b2df7a52c33
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                                                      • SHA256 ec1fb741946992a93dd4f0b8743fd43379d9978746bab521ee9dd639509fcfed
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                                                      • SHA256 d444b995e79d2ca1348b4493ef124c7734c9029c8140047fd0345fa820e18e21
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                                                      • SHA256 92bcc8bb20d982094643c31b41333c2759572952c98391b6be77fb26c4cb912b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                                                      • SHA256 7758c429eccdacc724f0979db9f0d267683cccfb0e0580127ef953d010175b20
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.7MB
                                                                                                                                                                                                                      • SHA256 de0b535a57415199732cc21ae191911b81b4b0ab3d1efb4edd24496465758dcf
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                                                      • SHA256 c6941ae722d3f9aaf18158f922a73decb868c71c49c9fabe5c78d38be550b1d4
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                      • SHA256 ebfad8dbff75baeaa886ae5bcd8f4c5f48583f1d05a6494671022dc0f1ab549b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                      • SHA256 3413ad8c5ab6242248d31759bbc3aa77c0549c3d90a4c13d2176f0f8d1f04a69
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                      • SHA256 a841a76cfa14491ee7a9bf7ccaf14f259d261efe1358491c9305d3437572adbc
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                      • SHA256 e65f362ca9d0bee2f48ba48d87f377ac94ea2ce3242aa649ac198bb45308126a
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                      • SHA256 a38c07bfdc1f2f4399406808034348b83e50c299ea11976fc3a17a569e8c84af
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                      • SHA256 bce211b4ad6f26bd2b6053229a9c893229fee0dbffc3f853e4d1f78d5d44752f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                      • SHA256 178b78f9119b5b540c2cc6446e30b2732349129bce5162b654e80e152d2dd867
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                      • SHA256 3a04553d41530ce5d876bc3013680c6f206ffe3fecc38a92f021b4e3759efcd5
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                      • SHA256 9e23e9e8228ec1c9919e7ae9941ccb507c92335cad8cd826e8e124ba7c3cff9c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_f6fd7e6603af27d4214a11dd8a312bed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                      • SHA256 9d56613db02c1001e9de87d98f6a3011541561f14fdff155238e0330bded2b7d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Logo1_.exe
                                                                                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      _desktop.ini
                                                                                                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-4280978039-528710165-233981602-1000\_desktop.ini
                                                                                                                                                                                                                      • Size 9B
                                                                                                                                                                                                                      • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      memory/264-8937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/476-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/576-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/628-8528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/700-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/708-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/764-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/968-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1000-8240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1120-8925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1144-6028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1172-8582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1216-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1276-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1392-8232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1396-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1424-8901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1444-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1492-8594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1552-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1556-420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1568-8871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1752-8877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1780-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1884-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1976-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2024-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2052-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2092-8315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2100-8190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2104-8991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2108-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2160-8883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2212-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2220-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2224-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2228-8606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2268-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2296-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2332-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2380-8961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2392-8859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2408-8847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2424-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2432-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2456-8440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2496-8726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2504-8967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2532-8811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2576-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2736-5551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2764-8540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2808-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2844-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2860-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2908-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2916-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2920-8792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2940-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2976-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3040-9003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3112-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3116-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3160-8943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3168-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3224-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3244-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3296-6036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3324-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3344-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3368-8919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3380-8750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3392-8829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3408-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3440-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3444-8804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3448-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3452-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3480-6321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3480-1836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3480-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3480-2546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3480-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3484-8907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3496-8823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3520-9009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3528-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3572-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3576-8835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3600-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3620-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3716-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3816-8648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3840-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3880-8216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3956-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3964-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3980-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4000-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4016-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4156-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4172-8600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4216-8979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4224-8714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4268-8756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4348-8320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4376-8865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4408-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4416-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4436-8949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4476-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4500-8732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4556-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4648-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4756-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4764-8817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4820-8889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4828-8985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4832-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4848-8780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4876-8340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4948-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4960-8534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4964-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4968-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5040-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5048-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5084-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5132-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5148-8997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5176-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5268-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5300-8696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5364-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5368-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5376-8370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5436-8955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5456-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5500-8973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5584-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5672-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5708-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5752-8798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5764-8666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5768-8841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5796-8552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5836-8853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5856-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5876-8895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5940-8931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5964-8708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5984-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5996-6048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6044-8738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6084-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6088-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6096-8400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6124-8913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6132-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6132-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download