Overview

overview

7

Static

static

3

2026-10-01...op.exe

windows10-2004-x64

7

2026-10-01...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 17:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
  • Size 4.6MB
  • Sample261002-v6gdpascmd
  • SHA256 58108e2d387614ed922db13991b47898b5129d1ec96f80903fd3f89b605e4c13
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E98.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3167.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3752
          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3212
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a353F.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5644
              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:124
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37FE.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2580
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1884
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A6F.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4812
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4016
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CF0.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1388
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5752
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F90.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:6076
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1292
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41F1.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1004
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5988
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45D9.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4364
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3604
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F6E.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4304
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:5424
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51CF.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2912
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:3556
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54EC.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2060
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4460
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5412
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5784
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A5B.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2980
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2408
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CCC.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2140
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4732
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F1E.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:596
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3832
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a619E.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5268
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2584
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6400.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5044
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4032
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6651.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3920
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3040
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6894.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:6112
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3712
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a699D.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1960
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:6036
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A88.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:836
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1656
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BD0.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2104
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5024
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CCA.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4464
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4104
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DF3.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1168
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1416
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F0C.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5976
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1708
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7006.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4948
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2340
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70E1.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2476
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1456
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71DB.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5700
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5548
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72B5.bat
                                                                                                                          60⤵
                                                                                                                            PID:2204
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:2268
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73AF.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:1864
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:5904
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A9.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:6116
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:1748
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75A3.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:2992
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5896
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76AD.bat
                                                                                                                                                68⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4532
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:1728
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7797.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4456
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1156
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7882.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:1136
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5816
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79CA.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:2176
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:5372
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AC4.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:4792
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2336
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BCD.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:5680
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:5804
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CC7.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:5324
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:6044
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DF0.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:2876
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:5140
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EDB.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3532
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3084
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FE4.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:5684
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4860
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80EE.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                                PID:5724
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:2920
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8217.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:5608
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5100
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8311.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:2720
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a840B.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:2344
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84E6.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:2608
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a869B.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1260
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:5420
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8776.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5196
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8860.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:960
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a891C.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:5208
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1064
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AE1.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                              PID:1992
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B9C.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:4836
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C67.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:5604
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:2124
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5344
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:5704
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DDE.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:1844
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EB9.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                      PID:988
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:8
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F75.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2732
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9040.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2756
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:832
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a910B.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                      PID:3368
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91E6.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:1828
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92B1.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:2808
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:1148
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a935D.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:4656
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                      PID:5440
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9409.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:2760
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B4.bat
                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:804
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:2252
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a962B.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:2024
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96D7.bat
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                              PID:2404
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97B2.bat
                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:5136
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                    PID:3144
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98BC.bat
                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2616
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:3536
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9987.bat
                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                            PID:2604
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                PID:3812
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A33.bat
                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:5536
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4608
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AEE.bat
                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:3080
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BD9.bat
                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:1476
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:1876
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CA4.bat
                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:5240
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2928
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D6F.bat
                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2716
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:728
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:1192
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:2568
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ED6.bat
                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5112
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2028
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3140
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:4144
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:2824
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA147.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA212.bat
                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA54E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:580
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA752.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA975.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB637.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB78E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB82B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB905.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC00A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC133.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC346.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC402.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC588.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5096
                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                22⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                PID:2164
                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                  23⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  PID:1820
                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                    24⤵
                                                                                                                                                                                      PID:3088
                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:4804
                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                            3⤵
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:3044
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                              4⤵
                                                                                                                                                PID:6056

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              $$a2E98.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2E98.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 504c51a07851f031338f048c83a713a3cdb63dde1fc8a2d4b1ab211427e3f378
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a3167.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3167.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 fe3ed6bfa8cac63d50d030237a221ccd073c4b60fc8895755d372a9b32c8a9e7
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a353F.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a353F.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 389507513a1443413ec459f4f7f8b60fec0c9fbbb12884174894246f5073567d
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a37FE.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a37FE.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 cf1853a193d3f5a75c0d645e4ccad56dc9453e9dc1ee6c5bc39cb163d3583b36
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a3A6F.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3A6F.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 789ac5df60ef06e6244818fad785846ff0e4390cad145e0ec24b01f4df9133e0
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a3CF0.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3CF0.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 96d952fab09c0913b74d4cdc3284f547d274a6bca3fa7af6db085eb29bb4492e
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a3F90.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3F90.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 fdc81c78e260a2e8b887f1dac66c21ab53752447def747b337847f2a8cef55dc
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a41F1.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a41F1.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 5ef7f96a8e786dff8ecd33c844bb75d59e932c961dc2759bf54b9f0445ed4f91
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a45D9.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a45D9.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 098fdfac7ddd246ed841faa5bcca0dea53f3e172eb4969a9629f5c858021081b
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a4F6E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4F6E.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 72fede680a1213e3cca793d41298b6d3bf99bc257b0676b282c53d50ca9780e1
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a51CF.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a51CF.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 9a31b5940f54533af4f68675d149a0f7001574fc40f8d57bde2212e096fca510
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a54EC.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a54EC.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 88d1ed08ee6107008c9e98db1181c54b1a0622d98f0b1ffe0cb7cc56b3207539
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a576D.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 0c87af639539bf4bf48a222ba8f8a09038d46ac59f2bd541df2a99cc5a0a1e73
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a5A5B.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5A5B.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 7f4bf2e452ee833dd75168834f65e1f68a395076f72645003f07dee8fc8ffeb7
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a5CCC.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5CCC.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 41445919a5909ced43bd7cf6d244a906049e4b860b25d01fa6919031ffa214f8
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a5F1E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5F1E.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 38f124982298f3805d88e8dcaf3a6677d3b9fad59283ac79703e7639868deffd
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a619E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a619E.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 9f8b597eb3b2c561e5f27a6e8b806e1409205c1ed0bf219279669e3a5099996e
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a6400.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6400.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 5e9c6fe6003b9efcd5d6b55f2ceeac41d3b798e27f14364824b82dca65781596
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.6MB
                                                                                                                                              • SHA256 d724858e937e7d6dbd5aa6be64d3b6f401230e41b6ea6e8d0a3933ea50798ac9
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.6MB
                                                                                                                                              • SHA256 c5c0b563c112a4495b34db48f123913487950eb0dfea3ff82bfe90368272901c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 f09e4f1427d4ac39e07fa77fd25abc4cfdcbfb9db3bc5bdebc29ef366c73add5
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 eec636e78e4f38e30f62d20aab955a24210fcef6eb1b5de23ec24425b018ef48
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 f566ca842e4e2245f5fb32877fa57f7479c665a16a316fe42909cfee3e81a965
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 c6c4d42d88d4114c6b08e6ba8448e3ec5e97deb6079d86b800da6a9ef28c1df1
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 43ffcaab19ec2eac66a4915d8d442449749bc1ea0e68ca0c519abb0255e607f5
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 84601c20365ddb1c2abe9bf8f8d3166834d66c9585b0902733c46f68807cc1df
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 def1879b1c08182f0f4ecea4fcbfb4d6979c9d21f05933f9a91005327706c118
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 1c8f6c095df270f2bc2538153b424d9ec413e21c3e3e669eb7cca1812d2f469d
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 c6702668586199a38f28a65abf7a2c6ac52af60f5fe1053cd04d4be05f9a0fe0
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 314e0cb23c197b3b5b9daaedcf7ea4cdaf0fc672754bcabb07a6453d9019d7f5
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 63c0fafdeac9a636fa9b0cfc9d54f331fba20d2450b3d633cf17ba45b9ef791d
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 6e25caa1edf9f96188f7568bad2ff553c61c96a32118cffbadd9c1adfba21eb3
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 e65e13b8d7b652ca5cbb7c6c3a72160d210bff551e7ea8738f183958bbeea027
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 e8b6cba0c1db65d253aeea8eb915c62082a7327e0f8f9de978ef847ec042ec55
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2c1ff8849a14d36f1133056c5eb97ef5_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 ed1a914582d4f2f64881d1e2a3f198d045abbf6e073e07bd5ea191df3e7cee85
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Dll.dll
                                                                                                                                              • Path C:\Windows\Dll.dll
                                                                                                                                              • Size 68KB
                                                                                                                                              • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Logo1_.exe
                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                              • Size 32KB
                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              _desktop.ini
                                                                                                                                              • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                              • Size 9B
                                                                                                                                              • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              memory/8-2215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/124-52-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/200-2687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/728-2343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/832-2227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/952-2519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1148-2245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1156-2069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1292-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1344-2596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1416-2009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1440-2484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1456-2027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1464-2407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1596-2659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1656-1990-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1708-2015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1728-2063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1748-2051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1828-2239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1844-2209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1876-2329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1884-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1888-2716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1888-2710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2024-2280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2028-2357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2112-2442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2124-2197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2128-2400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2164-2071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2164-1972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2200-2694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2252-2273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2268-2039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2336-2089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2340-2021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2344-2143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2380-2233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2404-2287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2408-1927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2500-2191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2568-2350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2584-1955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2608-2149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2720-2137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2724-2449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2732-2221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2736-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2748-2435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2780-2393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2812-2575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2844-2498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2852-2372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2920-2125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2928-2336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3012-2477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3040-1970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3080-2322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3084-2113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3144-2294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3192-2624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3196-2161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3200-2652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3212-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3228-2533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3272-2638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3332-2617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3344-2603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3388-2631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3432-2505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3536-2301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3540-2470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3556-1896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3604-1867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3660-2666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3712-1973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3712-1978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3812-2308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3832-1946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4016-74-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4032-1964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4104-2002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4144-2365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4260-2456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4356-2414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4372-2386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4460-1907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4492-2179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4560-2421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4608-2315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4632-2266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4644-2708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4688-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4688-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4700-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4732-1936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4732-1938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4732-2004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4800-2589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4804-1872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4804-1858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4804-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4852-2568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4860-2119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4868-2259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4904-2491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4908-2540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4912-2512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4964-2526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5024-1996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5100-2131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5104-2167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5140-2107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5164-2547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5312-2701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5372-2083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5416-2554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5420-2155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5424-1884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5440-2252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5548-2033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5596-2428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5636-2645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5704-2203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5720-2582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5752-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5764-2561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5784-1918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5804-2095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5816-2072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5816-2077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5836-2673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5880-2680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5884-2173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5896-2057-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5900-2463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5904-2045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5988-205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6036-1984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6044-2101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6064-2185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6080-2379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download