Overview

overview

7

Static

static

3

2026-10-02...op.exe

windows10-2004-x64

7

2026-10-02...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/10/2026, 15:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
  • Size 5.7MB
  • Sample261003-sf2wlass2k
  • SHA256 2c2a5b6e5c9a5b5d733ef4fd7f8c6067e99c91808df1eaa98446fb07f22b643e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5176
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A37.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:740
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AF3.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1112
          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2252
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2E2.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:6040
              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1072
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3DC.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2084
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5984
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA709.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5364
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5748
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA83.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1628
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:5576
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE1D.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2212
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3388
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0EC.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5516
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3280
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB495.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4508
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4984
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB949.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5724
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5232
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD02.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4492
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2360
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC06D.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3788
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5804
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3A9.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4956
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5128
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC87B.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5780
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5720
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCF0.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3948
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5428
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD29D.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5744
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1480
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD608.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4260
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5524
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB67.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:640
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2504
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D6.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4404
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:6028
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2BA.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3396
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3900
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5B8.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3512
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5016
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE913.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3524
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3520
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA1D.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3284
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3540
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBA3.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5672
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2512
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED1A.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1720
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5300
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDE5.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5048
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3384
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE62.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4772
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5116
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEED0.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4028
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:936
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF3D.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4760
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2144
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFAA.bat
                                                                                                                          60⤵
                                                                                                                            PID:4208
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1660
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF066.bat
                                                                                                                                62⤵
                                                                                                                                  PID:5680
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4540
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF150.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:2648
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:1652
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1DD.bat
                                                                                                                                            66⤵
                                                                                                                                              PID:5288
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                67⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5064
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF26A.bat
                                                                                                                                                  68⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:4632
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    69⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:684
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2E7.bat
                                                                                                                                                      70⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5460
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:1256
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF354.bat
                                                                                                                                                          72⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1704
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:3172
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3E1.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:1640
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:4152
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF45E.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:3408
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:1224
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4CB.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:4732
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3236
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF548.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                  PID:2244
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:220
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5B5.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                        PID:3036
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4868
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF652.bat
                                                                                                                                                                                            84⤵
                                                                                                                                                                                              PID:5484
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                85⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:1760
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6BF.bat
                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3916
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF73C.bat
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:5020
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:1372
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7D8.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2596
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF855.bat
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:452
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:760
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8C3.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                    PID:3724
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2044
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF940.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                          PID:4908
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2008
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9BD.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA49.bat
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:864
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAC6.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:1128
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB24.bat
                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:2112
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBB1.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                    PID:112
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3616
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC3D.bat
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:1988
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5796
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCBA.bat
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                              PID:4008
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD47.bat
                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4064
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE31.bat
                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9F.bat
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                              PID:5932
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:2188
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF1C.bat
                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                    PID:5696
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4972
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF99.bat
                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1844
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6.bat
                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:4860
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73.bat
                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:3468
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:5192
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a110.bat
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:212
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18D.bat
                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                            PID:3356
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EA.bat
                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D5.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                    PID:868
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                        PID:5112
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a381.bat
                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43C.bat
                                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                                    PID:5728
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a507.bat
                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                            PID:1348
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:3108
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a611.bat
                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1508
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4576
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EC.bat
                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1912
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a778.bat
                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:4852
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a805.bat
                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A1.bat
                                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4356
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1244
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93D.bat
                                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2428
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:2496
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DA.bat
                                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3504
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:2508
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA66.bat
                                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3060
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE3.bat
                                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51.bat
                                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC79.bat
                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1052.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a116B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1207.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1478.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1515.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a166C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1786.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1803.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1880.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a191C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B6E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CE5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2021.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2159.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a230F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2447.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2532.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a266A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:60
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2774.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2800.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a287D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a290A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2987.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ED6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F44.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a306D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3186.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3222.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a330C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3464.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a354F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3687.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3704.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3791.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a386B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3917.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B88.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BD6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C44.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                PID:2016
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                  PID:2724
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                                                                      PID:856
                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                      PID:2304
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:5760
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2940
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1008
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1008
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                        PID:4048
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2304 -ip 2304
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:220
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2304 -ip 2304
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4052

                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            $$a9A37.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9A37.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 9ab722534422d2a2bac84e8db2d5f436109ee5b930b403ae851af0137b229c7c
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a9AF3.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9AF3.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 f9372e6d52ab023dbccb7b2c6c1962345e05164a5c53ae24267c3ec22eba1a3a
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aA2E2.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA2E2.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 81482a10a5abaeae47a41575ee722264ac358241d7ac582103d105fc1665192c
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aA3DC.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA3DC.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 706a53cbcb380ec203cb25c446883250e79b5c6bf91464445393b9675992bdfb
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aA709.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA709.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 6b9d5737f3b15e4982555f83700c8501cf2e62631a044be49782910483f4fad2
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aAA83.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAA83.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 4cb9800d4a0284cf6cd675107d6a84955145d9c7f275c5139ce4d213ef6520c1
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aAE1D.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAE1D.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 482c2b091d65e0de24edfb30cef10fcc82026de915661377e350a584a91cb547
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aB0EC.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB0EC.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 ef4a4b07cd0003ef5e7d32b1d540253abc586e9bfb4812e1175b03280e9adff4
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aB495.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB495.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 3b5c16995e4c4f04e0d7f0d1ce95adb08ce36c2acf890c7debe214f2123e2496
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aB949.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB949.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 cf5e1b7ed26368a35a16b55abd07d1283b4f252b572be9e440faf9ec7011cce9
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aBD02.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBD02.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 05395bfc84c384e2aa0776c57d5331eb902203bfa164f1ccfcfab74b1d1cfcba
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aC06D.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC06D.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 30363a87726a2da9fb9107b34da6971681313119c364502bff71596eda5b07b6
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aC3A9.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC3A9.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 916df718992d8d62243baa0fb7ca01aa7df8642b90b8acfceb8aa4332c932cf8
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aC87B.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC87B.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 0c977f1d011f33ba81f5685d87c2c6bc7c476931ad1f53781bfe43e3c325511e
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aCCF0.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCCF0.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 6fca221a304205bd46527eb57bf693a427369768d5b046fe6bb20cb83b03f47e
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aD29D.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD29D.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 a0420f8e719747c34bf1e40964b65ff6cbc3947c3b511b4fdd1f0be9e27e8ec1
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aD608.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD608.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 126acff3d045ec45d9a30d4911c9a2afbcb3ae3eb0f1ba49ce2a8c1a06d440d1
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aDB67.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDB67.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 827e7e92a701d921996df941845552c973d306b991a860dcaa955ec9eb676634
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aE0D6.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE0D6.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 f1060e6d727acaedf5300809f0831ba1e47e70c1ebbfbf006abf206e81650a55
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$aE2BA.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE2BA.bat
                                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                                            • SHA256 f6112674f8884d2b2a2eec1c67db0c77fe4b8625f38e5a1dd2464b589967b875
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                                            • SHA256 6d7ead2dd525cd50b086b4b4090ff61ddd7e119262df3d25c05408a858a70af3
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                                            • SHA256 ecc5a2d2a39ddfb90e473dc40875adcd496941f02c6ac90ac198d119112af2b1
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                                            • SHA256 2518c700b2c2da4810f3a9e09cc52526b443d67c9d853c23bdea597bbdfe0be2
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                                            • SHA256 c08a6752893d58453794968268e7917eca485794e861e6f10364609ba8191658
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                                            • SHA256 26b2c12794c101b5a7bca84920142cde135a1622d0c9ce69a6d88c72cd721b60
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                                            • SHA256 052ecf8db5e000ae42af859da4344b4e3f902098f159f3616c0ebf2b7283ae7b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                                            • SHA256 350588db9488955f3efc8b4f72d3669eb1d9cd15d5ec72d4a479ff768e8d9cac
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                                            • SHA256 66350bc690662d2f3d63a3611891ccaa3419d333857a17a4f51df0f0c16d13cb
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                                            • SHA256 e135a84dbdd3e68874d38f6fbbd08c9081a13ee91792d5ddf15ee859d085d15b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                                            • SHA256 64a48e0709af93a8098b3cb248f0e1c3e29e3493eb2fec560fd462816ba045cd
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                                            • SHA256 5765f973ce700a59929680d925d3a81b3382412854d87b3fff53e777d2bf349e
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                                                                                            • SHA256 a1e72903f0b97ebe0c189e95d404f2343b7ee07c1cd87bc5aff16a28f1731010
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.7MB
                                                                                                                                                                                                                                                            • SHA256 b1f09eeaf786c817b1eb84b322ae08fa46f9415d71d4bf9cfba869716e8b4819
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                            • SHA256 c0e0c450f7d5cae0cdb51c30317be2d0832dfdb60ba04ec7d92cd92210ed7bd2
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                                            • SHA256 9a23d08645af7f4ad32e0ae31a8a0522a70e3cc45477048f1967023732ccf5b2
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                                            • SHA256 04e43bff191e3da1ba3603821dbd8c4e520a6c8f409857eebeff38475972b9ce
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                            • SHA256 aa809baab83f4d3e232b1996dcb76aed54951b92769c240ae08b020e53277ae9
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                            • SHA256 154b49ae20dde0cfad653b1269a1c7a2e44ab9289f8e8429723f5fba9e760ebc
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                                            • SHA256 e4be8df226e86e003c8f25ac1b1acb4d9d209b12db7b34d6e0762111c57f86a8
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_3098f4777c6981f87bcea8cd8e32ceed_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                                            • SHA256 e03ae45a09c748ae68fe0a3f6c71b27276234d8b93d638b343d5b17f17c106b0
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                                                                                            • SHA256 004b1cc70b055dd97ad5615423416608553b34793b54437a15a4fcd3e84907ab
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            memory/60-4689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/212-4340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/220-4224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/624-4460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/684-4194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/740-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/752-4605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/760-4254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/804-4857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/864-4274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/936-4162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/980-4671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1072-41-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1104-4527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1128-4279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1180-4647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1212-4665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1224-4214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1244-4406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1256-4199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1344-4569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1356-4599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1364-4761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1372-4244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1472-4436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1480-2655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1548-4509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1620-4713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1624-4617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1652-4182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1660-4172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1700-4635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1736-4803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1760-4234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1812-4725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1816-4833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1912-4388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1952-4773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2008-4264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2016-4185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2016-4135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2044-4259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2068-4575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2124-4683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2144-4167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2156-4478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2188-4314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2252-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2288-4442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2304-153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2304-932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2304-4117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2304-4128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2304-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2324-4545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2332-4239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2360-861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2460-4653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2488-4496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2496-4412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2504-3609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2508-4418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2512-4142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2524-4324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2540-4424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2552-4677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2576-4695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2780-4743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2796-4515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2828-4466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2848-4659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3056-4731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3108-4376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3164-4430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3172-4204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3236-4219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3280-157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3356-4346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3384-4152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3388-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3424-4400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3440-4448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3520-4126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3528-4701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3540-4136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3616-4289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3664-4845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3780-4587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3804-4839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3816-4815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3900-4115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3936-4827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3964-4755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4152-4209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4200-4521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4220-4490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4268-4851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4316-4563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4344-4779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4388-4533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4408-4309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4416-4797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4512-4641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4524-4821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4540-4177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4564-4284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4568-4593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4576-4382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4584-4364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4600-4472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4640-4304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4684-4767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4688-4484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4712-4581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4796-4394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4816-4503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4860-4329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4868-4229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4928-4299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4948-4707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4972-4319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4984-2647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4984-545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4996-4539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5016-4121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5024-4737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5040-4749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5064-4189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5112-4358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5116-4157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5128-1940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5136-4809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5176-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5176-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5192-4334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5232-801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5292-4623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5300-4147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5332-4454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5356-4785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5404-4863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5428-2500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5476-4370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5524-2976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5548-4269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5572-4629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5576-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5600-4791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5720-2410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5748-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5752-4557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5796-4294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5804-938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5856-4352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5888-4611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5984-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5996-4719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6004-4551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6016-4249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6028-4105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download