Overview

overview

7

Static

static

3

2026-10-02...op.exe

windows10-2004-x64

7

2026-10-02...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 16:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
  • Size 4.8MB
  • Sample261003-tk28latwcs
  • SHA256 55cc0390a12fece686118896db986c35dc5bafee0548e9b68bb428b0ecf751bc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 43 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F32.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42AC.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2528
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44B0.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2204
              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2644
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46E3.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4388
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5520
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49FF.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3416
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3932
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C42.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5856
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4924
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E74.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1908
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5052
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1124
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5852
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52F8.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4448
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4976
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a553A.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4516
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1964
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1368
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5920
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5990.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2972
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3972
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BB3.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4652
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4744
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E24.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5200
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2268
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6037.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1284
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1352
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a696E.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1940
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5464
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AE5.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3012
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5880
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EED.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4180
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:6116
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5352
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5028
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E9C.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2896
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4668
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F77.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:212
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:240
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8032.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4264
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4792
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80EE.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1708
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5492
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C9.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5832
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5504
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83DC.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2084
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3496
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84A7.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4952
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3424
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8563.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1792
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3388
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a864D.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4740
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2596
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8708.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4704
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:4980
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87C4.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:988
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5800
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a887F.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:1828
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4808
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a892B.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:1796
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5644
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:2196
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1520
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AC2.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:5376
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2876
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9253.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5484
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1984
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92FF.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:2636
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2052
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93DA.bat
                                                                                                                                                          74⤵
                                                                                                                                                            PID:5740
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:6076
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94D4.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:1900
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:5836
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9570.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:1332
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3600
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a963B.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1480
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:2540
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9706.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3736
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:5476
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D1.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:4896
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4116
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987D.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1144
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:2780
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9968.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                              PID:4636
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:6096
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                    PID:5896
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:1336
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ACF.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                          PID:4944
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B8A.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:3136
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:3180
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C84.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1388
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:3380
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D40.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DFB.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4756
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:3204
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EA7.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:2836
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1808
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA02E.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:1140
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0E9.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:3944
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA186.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                    PID:1868
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5908
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA222.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2CE.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:3312
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:1960
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA36A.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                  PID:1328
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:5048
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA406.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4764
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4A3.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:6124
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4164
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52F.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:5068
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:2508
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5DB.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                        PID:6036
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA697.bat
                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                  PID:1544
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85C.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:5172
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:5828
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8E8.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:3808
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA975.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                PID:764
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA02.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:2344
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:3580
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA8E.bat
                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:5616
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB2A.bat
                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                              PID:2056
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABB7.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:2416
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC34.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                            PID:3356
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                PID:5088
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACC1.bat
                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:120
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD5D.bat
                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                        PID:200
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:4168
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADEA.bat
                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                              PID:568
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2668
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEA5.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5888
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:5876
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5480
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:428
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFDE.bat
                                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:5860
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB07A.bat
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4984
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:908
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB27D.bat
                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB397.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB433.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB53D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB646.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB84A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB982.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAAB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBD4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFEB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC068.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC114.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC337.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC460.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC52B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC644.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC857.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC932.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3680
                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                  PID:5600
                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                    PID:4676
                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                        PID:3012
                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                            PID:3764
                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              PID:4600
                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5316
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 836
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Program crash
                                                                                                                                                                                PID:4792
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3764 -ip 3764
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:120

                                                                                                                                                                            Network

                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                  Resource Development

                                                                                                                                                                                  Initial Access

                                                                                                                                                                                  Execution

                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                  1
                                                                                                                                                                                  T1059

                                                                                                                                                                                  Windows Command Shell

                                                                                                                                                                                  1
                                                                                                                                                                                  T1059.003

                                                                                                                                                                                  Persistence

                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                  1
                                                                                                                                                                                  T1547

                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                  1
                                                                                                                                                                                  T1547.001

                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                  1
                                                                                                                                                                                  T1547

                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                  1
                                                                                                                                                                                  T1547.001

                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                  Credential Access

                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                  1
                                                                                                                                                                                  T1555

                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                  1
                                                                                                                                                                                  T1555.003

                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                  1
                                                                                                                                                                                  T1552

                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                  1
                                                                                                                                                                                  T1552.001

                                                                                                                                                                                  Discovery

                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1120

                                                                                                                                                                                  Query Registry

                                                                                                                                                                                  1
                                                                                                                                                                                  T1012

                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1082

                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1614

                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1614.001

                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                  1
                                                                                                                                                                                  T1016

                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                  Collection

                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                  1
                                                                                                                                                                                  T1005

                                                                                                                                                                                  Command and Control

                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                  Impact

                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                  Downloads

                                                                                                                                                                                  $$a3F32.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3F32.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 117c0d9063a9bf8a8e15df962442e37dafc20367e8db0eb5bf3184801e2f700c
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a42AC.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a42AC.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 9079a614e441866e6793e96d07bfd3abd15e39ab39845666f0a392192596c6d9
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a44B0.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a44B0.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 5f7bc631f30206f74802b2f59d39345f33c51cf12a9b1f75fd8d68b9c229f561
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a46E3.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a46E3.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 72cae8652c53213a52d6c78664389ccf5f98779a268c62854b7f6633de72ae27
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a49FF.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a49FF.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 553011c6a5420d3a47910e92b1f76125321e0f217e196da0aeaf3161c3fc29af
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a4C42.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4C42.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 8402c13efd8355d3b98f521746018a4fdfbfdf9001dd20aead94e8940d3e0390
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a4E74.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4E74.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 4476760bad8b6f3d29109882cda4d93dd3a58bc4ac6c004d213f328d83e510a9
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a50C6.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 3149f4acafe3345e1e5b53a071e225db01fd4bde038058b28280324f4f565db6
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a52F8.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a52F8.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 51d7c6a7cba7606ecfee0a21b9da6a46e413dc5afedbd0a067870023459c7794
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a553A.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a553A.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 94eb6618f84440870f741476b4f798a45a1029a82d48e59347ab35e57163a977
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a576D.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 e5af7393a9372f3359ffc21908286c1727dcfe3b605842badcbc36ef18799421
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a5990.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5990.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 45517f74c6407991acc633dc9b99b73b551988c4d5f1cb1b2cea8875d5d26cbd
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a5BB3.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5BB3.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 2ca2f2323ad0bbd8447ba7ae82b870417ef83dbdd01f9856ee73e5ef826034eb
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a5E24.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5E24.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 fe46fdbddf1c6abc56a999b0eb373df51b386ce03a0f5dfc2385aa93b52b7413
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a6037.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6037.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 953de832a0f6a2d081e870a48ec6165f9a7f9c3fa7c17e3a3571375f227988e7
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a696E.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a696E.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 7ac22ae9b9b147ce0cc71421853c0e031c88943355b08ee1da5a469d4ac0f324
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a6AE5.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6AE5.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 d7276ca3678847b9549fbcdb04f45e14dd14853e504be227eec288efa7421e0e
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a6EED.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6EED.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 6e141512bcf0e2d9ac786af3070e82cc3f74246933f1c19d9fd487bf199c95b1
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  $$a7A18.bat
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                  • SHA256 980b1022e5ec9b8a427e728f6dcc538c27556634070a5c9ca995bc3ca0428700
                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                  • SHA256 221c2b60e72684153f2d10d476dff86b06dfc278487d8069555b87ead4373cc5
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                  • SHA256 404542cb93e41c7cbe388c165560dae2f869b6a493a29ffc5eedb0ecf8f6781a
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.2MB
                                                                                                                                                                                  • SHA256 adc7f308ab8b4385d70beaf5068574c21f662290abbdd6b3d1a03b94b7de11fc
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.2MB
                                                                                                                                                                                  • SHA256 4c701392eec3cf3ace5d6b79d1f35064061153664bec563bc7fde7eb8f015d62
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.7MB
                                                                                                                                                                                  • SHA256 aa217c326aef337be9539155b7379c86179482ae81a3ed38a294906103ce9b5d
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                  • SHA256 7c3d881c85493945fce6ad9baff73ac496a8f649446b810090e2ad623ec7eab5
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                  • SHA256 eff4a240d8c6e7d01d9d292e3033539b02e40b9aa57b6878c8253864e73720f9
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                                  • SHA256 0e233441d35145ddda9c6a6b6afd3f8d782ec1d59269f4cb1806a768a4ce4fe9
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                  • SHA256 ea296f050d38c084c198a21732b7c51d7417f286b30a8aa96206c2d0d5ea2d9f
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                                  • SHA256 13be6538ee4d8bc8a1a0b99108e08a81f5b31ec8a4123f321a66ab6c83698dfb
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.5MB
                                                                                                                                                                                  • SHA256 8c6d20e304e3760ca0c6893f580bc3afe8fc6ad8baa09fdc2f54cfc563d3f890
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                                  • SHA256 cae496ea5168c2c6a3cdceb78906b4f026928d6bff2fe4abc322fe915d31d2a3
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                                  • SHA256 eefaaf78b5472358e0f533af7df8982a51afa0f883baaaa198389c5e44a3df60
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                                  • SHA256 0432a5234783b24ef2888be6bf9267bd67419ff23ae2b8265e091d0c57a8abff
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.4MB
                                                                                                                                                                                  • SHA256 241336cd26766a810ce5bb6868c8944b73be8fae16910411d7820022f657389f
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                                  • SHA256 119a5bee8b4d4d194b72b775174580ea4fa71bd76e4640d65dd78e1b29cfe021
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                                  • SHA256 e4cd0861b164e826f18542a01907a46f521bfe3d64648b88afca121c3fc103cd
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_20c9f5ae1399db6e91a4c7ed236767e7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                  • Size 4.2MB
                                                                                                                                                                                  • SHA256 33a3b3288f45e27e1a294f63cff93a65a1f0ce732e3412b57c290b0f3361c465
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  Dll.dll
                                                                                                                                                                                  • Path C:\Windows\Dll.dll
                                                                                                                                                                                  • Size 68KB
                                                                                                                                                                                  • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  _desktop.ini
                                                                                                                                                                                  • Path C:\_desktop.ini
                                                                                                                                                                                  • Size 9B
                                                                                                                                                                                  • SHA256 004b1cc70b055dd97ad5615423416608553b34793b54437a15a4fcd3e84907ab
                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                  Submit Download

                                                                                                                                                                                  memory/240-5676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/260-8902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/428-8607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/456-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/764-8537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/784-8705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/936-8867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1072-8909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1336-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1352-1927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1356-8733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1364-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1456-8838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1520-6213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1544-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1704-8747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1808-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1864-8719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1956-9022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1956-9016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1960-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1964-121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/1984-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2052-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2068-8635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2100-8810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2180-8824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2200-8831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2268-163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2348-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2416-8565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2508-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2528-32-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2540-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2592-8796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2596-6179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2612-8923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2644-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2668-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2696-8986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2780-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2872-8754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/2876-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3128-8979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3132-8621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3180-8416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3204-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3208-9000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3288-9014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3364-8852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3380-8421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3388-6173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3412-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3424-6167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3496-6161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3524-8789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3528-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3532-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3540-8761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3580-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3600-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3644-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3668-8888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3700-8691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3764-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3764-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3808-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3848-8782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3932-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/3972-143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4116-8386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4164-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4168-8586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4184-8937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4280-8916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4308-8726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4340-8881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4368-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4408-8775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4544-8944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4572-8663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4576-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4580-8712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4608-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4644-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4668-5670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4744-154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4752-8930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4764-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4768-8951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4792-5682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4808-6201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4824-8965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4828-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4892-8670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4900-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4924-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4956-8817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4976-110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4976-1961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4980-6189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/4984-8628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5000-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5028-5664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5048-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5052-89-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5064-8649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5080-9007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5088-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5092-8579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5116-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5116-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5164-8993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5256-8972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5300-8803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5372-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5384-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5464-1936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5476-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5492-5688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5504-6155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5520-53-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5600-5026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5600-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5600-1571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5644-6207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5800-6195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5824-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5828-8523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5836-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5852-98-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5860-8614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5876-8600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5880-2252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5908-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5920-134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/5988-8874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6000-8845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6076-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6096-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6100-8958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6108-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6116-5087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download

                                                                                                                                                                                  memory/6132-8895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                  Download