Overview

overview

7

Static

static

3

2026-10-05...op.exe

windows10-2004-x64

7

2026-10-05...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/10/2026, 22:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
  • Size 5.3MB
  • Sample261006-2gp3vsxs5r
  • SHA256 c9871de4aaa716d64b5dba31b346d8304a1e176afbe2765a05009e6259d02ca0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44B0.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:720
      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48F6.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1004
          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1768
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B96.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4380
              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1848
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EA3.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:256
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1392
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51FE.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3732
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:980
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5431.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:944
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5208
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56A2.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1476
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1180
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5932.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4484
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4620
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F1E.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1216
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2732
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a671D.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4576
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:1604
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A78.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4188
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:5568
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CE9.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5056
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5200
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F5A.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1444
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4464
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7219.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2640
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:244
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a748A.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4156
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4468
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2688
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5960
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a799B.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5664
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3524
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C1C.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6076
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4376
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EBB.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1400
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1452
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80FE.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3928
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3704
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81E8.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1772
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5300
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82D2.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3884
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5660
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83DC.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2404
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2608
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84E6.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1000
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4580
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85EF.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1228
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1292
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86E9.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1976
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5364
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87D4.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1280
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4656
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88DD.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1796
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5396
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89B8.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3740
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3316
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A93.bat
                                                                                                                          60⤵
                                                                                                                            PID:4236
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4144
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B7D.bat
                                                                                                                                62⤵
                                                                                                                                  PID:1584
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1072
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C96.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:5076
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4800
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D81.bat
                                                                                                                                            66⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3128
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5088
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E8A.bat
                                                                                                                                                68⤵
                                                                                                                                                  PID:4952
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    69⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1688
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F94.bat
                                                                                                                                                      70⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:6048
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4976
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
                                                                                                                                                          72⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2708
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3748
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9159.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:3380
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:5532
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9272.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1412
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:456
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a934D.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:2868
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3028
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9437.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:2352
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:1124
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9522.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4496
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:1380
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3008
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:4240
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96F7.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:4128
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:4460
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97E1.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:3908
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99C5.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:2020
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:2452
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AB0.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:5472
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B7B.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:5856
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C56.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:2340
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D5F.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                PID:5464
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5924
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E4A.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:4256
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:3640
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F44.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5704
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA01E.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:1164
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0F9.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1E3.bat
                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2912
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                            PID:4520
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:1568
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:5344
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3A9.bat
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:3456
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:2476
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA493.bat
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:704
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:1236
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA56E.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA714.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3636
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:2240
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7EE.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                    PID:5372
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8C9.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:2628
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:1580
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9A4.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                PID:5128
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA6F.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                          PID:5480
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC34.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                PID:1932
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:928
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                      PID:5736
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:2652
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE28.bat
                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:5192
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                              PID:2880
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE4.bat
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                      PID:2540
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF9F.bat
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB05B.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6112
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2484
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB116.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:1720
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:6024
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:5004
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6044
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB26E.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:1852
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3716
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2900
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5412
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4068
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:1108
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4CF.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:2200
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5D9.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1808
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB685.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB78E.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB84A.bat
                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB905.bat
                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC058.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC114.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC25C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC337.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC47F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC53A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC79C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC867.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB16.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF5C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD018.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD47D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD577.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD642.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD71C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD96E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF5A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE015.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE361.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE40D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE555.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE72A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE843.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE90E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBCD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED25.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                                                                          PID:3836
                                                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1008
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                  PID:3096
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5080 -ip 5080
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:2508

                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                    $$a44B0.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a44B0.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 f5d76d78945a3b3d8f94bc7195571efcedec68efae8a0e3f901e0826390564a6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a48F6.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a48F6.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 5ec176f7f0e761cf7f459856adb2ab1fa1a3a37e349c9e25c671f5072ce8ea0d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a4B96.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4B96.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 a6580a07027ee7657b0b4bc40dfe94c7b03dac664ef14dd514a240bb3d2c8c2d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a4EA3.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4EA3.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 efe76748217080fa087fc7a54265cfa663ea4c90850becf53335272c876d50bf
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a51FE.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a51FE.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 4c647a7e8c2450ce59f5f8ba387d80bf0fb29ae1f1534161f77af9bd855d6ec4
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a5431.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5431.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 5d4ea8ec830bafe2aab345075501129127093429d7a41f19164d26cc5733d8b1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a56A2.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a56A2.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 90d24e1a5089efa0279712060742f088684f5817852fb5f8aec5d823d05667dd
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a5932.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5932.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 078ec8584918fde314c3c683d8fe002d97987c3b09cc35606fffa9b61bea1fad
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a5F1E.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5F1E.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 1175f6cfa4d95202727bb62f12a8ba34c8b8bcf4dbd5e37151024cd50720404d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a671D.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a671D.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 b388ad94d82c25ece023f88be83b01965b99ae9a5c4e7043020030a95c2dcec1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a6A78.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6A78.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 edcb3870f1160ffca315c919fb46a7a163b295a09225e0caf278967652ef0ff4
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a6CE9.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6CE9.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 9d6b7ff4dd0df140cb29fbac784aec9dd9178302cebf13345caffd6cfb436cf2
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a6F5A.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6F5A.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 f925df03e8de6c4273f205b637d9e77805866fca8284f7ca87f01c1ba3348420
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a7219.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7219.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 c60572a591cefcf5bfed66897ab1fab4310860bc5573c0c1e4dfc10af164b71b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a748A.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a748A.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 06e8e40e48deac23c302b43c482f257ef5594e0043f3099a723de43776d20a01
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a7749.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 f8db5cfd2d18846d3e7ab48a42db95a35c870e5fc664dd1256b2513af05607f5
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a799B.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a799B.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 1a69793210d00184b289d67779f722d81d7ecf3badf626ce978d0c18a3bda1a3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a7C1C.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7C1C.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 fd526ec3f12dcecefb023a8cbec3f731c15185673c8a427b50c5b340d56ae70c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                                    • SHA256 bc9f232baab9965e7a83e5ecd88197e3237b1be4674bcbd418050b482ced38fc
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                    • SHA256 12a0c4c14ff7ce121938e1a355d36b38de2f616efc7f1b661775f5fa356e6c47
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                    • SHA256 3a305cb23dab43d33b8adf187f130627a8bcf79933796accd63c286327f1a090
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                    • SHA256 6c4d3b91b9041d4a42f35ebd916de6e785b1e65c2837861e33ecc7bd11e63e1e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                    • SHA256 ce876ab509343b4909c6f3471514bf2c0d6fd16bc34ba780fbff0d39dec0cf6c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                    • SHA256 6b7d389e0ddca86d237e6badd8f4b3059e90f81ee5a2a49202fe0e104d3324e3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                                    • SHA256 40b2b84324af9e19f3402e91c170d65a731d1fc976016b750f45814b31997cf1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                                    • SHA256 2280faade2dd619c17a0eb33f1a8bca5f20e616c0fae623e131365747ea92234
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                    • SHA256 1b19e4ccf348627e8e2d850055d7e84961a7a06c7520e6c5a0be26721ff78f53
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 4.8MB
                                                                                                                                                                                                                                                    • SHA256 e8340415afbe3cb4786ad8166669e695f26a596100dc9012695e442e69a090c1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                    • SHA256 11507d81d712fcfc7eb0fb14334ffd3bec0c7382009f457759393be6258fdae5
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                    • SHA256 76b52bb88da7490c5b77287f977dd4094e75104ecf3546df12d4f7b52b9fd659
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                    • SHA256 268bf1916f35051bcfeb55b5518c07f717caccea082454614444481a4472167b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 4.8MB
                                                                                                                                                                                                                                                    • SHA256 55ec1a7794cb42c882e3b05237f28d11cefeaa464885ab93df76da1cd7b3227e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                                    • SHA256 71349177e56e9bef2360b911d0af06db9d5224c8ef9853a6524d989eefc6b150
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                    • SHA256 530caf1a517acb32f2e838bf4db029ed6f01051dc179acf508702762a6519350
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                                    • SHA256 54919376143bff068897d22b59effcaa738b502d00698a840d009cb0ebb7adc8
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-05_6b10d3ed5cb69779f93dfa3f1620ee1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 4.8MB
                                                                                                                                                                                                                                                    • SHA256 7c95dc294e4493a244e78a91b31af1e9a779a0c13c5eebe19939b6b73f8633af
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Dll.dll
                                                                                                                                                                                                                                                    • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                    • Size 68KB
                                                                                                                                                                                                                                                    • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Logo1_.exe
                                                                                                                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    _desktop.ini
                                                                                                                                                                                                                                                    • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                    • Size 9B
                                                                                                                                                                                                                                                    • SHA256 e236861d16edaa3e1795d7648f9447bd62362c457fb1c152f587ad6571bb4d27
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    memory/8-2121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/240-2727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/244-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/456-2031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/564-2713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/792-2586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/928-2200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/980-72-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/992-2537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1072-1988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1104-2488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1108-2270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1124-2043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1180-92-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1184-2600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1220-2692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1236-2147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1292-1952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1312-2635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1320-2153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1376-2621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1380-2049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1392-1828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1392-59-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1452-1915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1560-2734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1580-2172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1604-1830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1688-2006-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1756-2341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1768-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1808-2284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1848-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1908-2355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1948-2481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1980-2565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2056-2404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2076-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2104-2544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2168-2699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2188-2411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2240-2159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2280-2720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2300-2755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2360-2439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2396-2579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2400-2657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2424-2193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2452-2079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2476-2141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2484-2235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2540-2221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2608-1940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2652-2207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2732-1813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2808-2762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2844-2642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2880-2214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2908-2502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3028-2037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3048-2277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3152-2073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3176-2474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3220-2530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3240-2741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3244-2369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3292-2614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3316-1976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3332-2097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3356-2804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3408-2706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3444-2593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3524-1900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3640-2109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3676-2748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3704-1922-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3716-2256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3748-2018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3784-2418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3804-2523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3832-2298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3852-2607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4084-2446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4136-2376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4140-2390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4144-1982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4192-2313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4232-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4232-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4240-2055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4280-2291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4304-2432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4332-2334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4352-2348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4372-2495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4376-1909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4384-2115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4460-2061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4464-1862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4468-1882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4504-2509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4520-2129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4560-2783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4564-2397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4580-1946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4620-601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4632-2228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4636-2790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4644-2776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4656-1964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4756-2123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4772-2320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4780-2091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4784-1917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4784-2020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4792-2558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4800-1994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4808-2649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4856-2671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4864-2067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4872-2678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4924-2572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4976-2012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4988-2179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5080-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5080-1179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5080-1817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5088-2000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5108-2685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5200-1851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5208-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5212-2516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5240-2306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5300-1928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5304-2453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5324-2467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5344-2135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5364-1958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5396-1970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5412-2263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5428-2628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5440-2797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5532-2025-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5568-1842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5608-2425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5660-1934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5744-2362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5764-2327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5768-2551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5816-2186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5900-2383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5924-2103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5944-2085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5948-2769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5960-1891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5972-2664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/6024-2242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/6044-2249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/6056-2165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/6060-2460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download