Overview

overview

7

Static

static

3

2026-10-07...op.exe

windows10-2004-x64

7

2026-10-07...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/10/2026, 23:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
  • Size 6.0MB
  • Sample261007-3rb5esht5r
  • SHA256 99a15f0d8b3390504e5eb5b6216b76472eddfdc8418e6ccb1d7b47e0d21e0539
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12B3.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4196
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1563.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:116
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19D7.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1488
              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4628
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D90.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3472
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3076
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20FB.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2420
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4568
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2495.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2096
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:2052
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2810.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4484
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1496
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ACF.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4212
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4000
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30F9.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1440
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4988
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a354F.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:1216
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2844
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3975.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2476
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3988
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FBE.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2340
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3148
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a405B.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4972
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3288
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43D5.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2980
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2688
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a477F.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1748
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5064
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E36.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2056
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2088
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5460.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2700
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4836
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a553A.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5112
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3488
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C5F.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2364
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1976
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E24.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4072
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3464
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61AE.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2628
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4472
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A6.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2660
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:988
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a670D.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2180
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2320
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67D8.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1708
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4880
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68C2.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4036
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3532
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69AD.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1336
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3864
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1956
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2936
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B62.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1132
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4372
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C2D.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1492
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2464
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:644
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4696
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D18.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2348
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:556
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E02.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:1668
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3752
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E8F.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:1100
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:1724
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EFC.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:3028
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4584
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a715E.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:2900
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:1476
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7258.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:3816
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:224
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72F4.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:4220
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:1764
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:1548
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2756
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73EE.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:4136
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:560
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:4272
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:2448
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74E8.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3568
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:1944
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7555.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:2444
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3556
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7620.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                          PID:2188
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:1664
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76FB.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5084
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77C6.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1240
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:1344
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78DF.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:3080
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a796C.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:1868
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1396
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79E9.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:2044
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1904
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A66.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:5004
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:2908
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BDD.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4520
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:7772
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8275.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                  PID:8076
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:5452
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a835F.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                        PID:5684
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:6832
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8478.bat
                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                              PID:6776
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:6656
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85C0.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:6600
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:7264
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a866C.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                        PID:7320
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:7420
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86DA.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:7448
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:7640
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87B4.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:7688
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:7284
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8851.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:7220
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:7524
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88CE.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                          PID:7580
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:7700
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                PID:7732
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:7792
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89C8.bat
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:7820
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:7880
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A35.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:7916
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:7968
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AB2.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                PID:7996
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:8052
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B3F.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:7776
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                        PID:8148
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0A.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:8188
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:4224
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:3032
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4716
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DFE.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                    PID:3940
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                        PID:4044
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F07.bat
                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:3736
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FE2.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:4148
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90DC.bat
                                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                          PID:5140
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9188.bat
                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                              PID:3424
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9234.bat
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5284
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92B1.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:5304
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5344
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a938C.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:5372
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9476.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5440
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9512.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5540
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a960C.bat
                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:5636
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96B8.bat
                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5700
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987D.bat
                                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9919.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6148
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6176
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6260
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6316
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6344
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6388
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6472
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6500
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6556
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA01E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA166.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA445.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA752.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA88B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA927.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC82.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB07A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB29D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB377.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB50E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB608.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB79E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB898.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB925.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC029.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC152.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC25C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC460.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC54A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC625.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC76D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC838.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC922.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                    PID:2556
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:3964

                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1059.003

                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1016

                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                        $$a12B3.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a12B3.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 b2371b2f6663d96fc60982c9ae8f13065013e358d4bb9e38bcb5e8e8b2cea8e6
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a1563.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1563.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 7532e48085c20f5e005d2fb135660c13ea811d9eb45c5eb3f8481098d2e46a11
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a19D7.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a19D7.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 7f15b76dca4c632be7862f56c39064c220c3c690406ab4cdd38bc5438e856c1f
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a1D90.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1D90.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 1dff4c92293fc16df29579510ade307b6c565b91a4e627ad241683291c26ac01
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a20FB.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a20FB.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 d38471aff54a436b49bfc4cfed182634d6130a2720ff1df9a4ad8d5e515a05f4
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a2495.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2495.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 d54d549b3b6acc09494a08eb13d615575dad033f6ebf82ee2ee8fd0e6bcc7154
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a2810.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2810.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 5a222af1f0b9ce50e0becd798ff767a3e8b8812f90667fd31dd502b253ffed03
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a2ACF.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2ACF.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 78110d035a196796ee4a61ab3f0ce85f87c63d7123a81f0fb9496f85e1251e47
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a30F9.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a30F9.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 c60c4561635fefd2a536caff6532a36950478422e588fca330a662adeb09e269
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a354F.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a354F.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 9b01e29e8adf960daf8b984b6b37563ac367ef971d13c05b37e5cab300184c2e
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a3975.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3975.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 3ab0cefe79f36e29caebe3ffab4e924bebf1b3aeb4fa3d45526824a776d7cb99
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a3FBE.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3FBE.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 d97e5fdd2b3a5c2d9c35b789e5a2ece2f2141ba50801bd7d5f717fbb17db6fdf
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a405B.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a405B.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 4991f0cdbb70ac4a1d20e229b5b49a92ad8dfee97cd333d1c2dc1ff26323c045
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a43D5.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a43D5.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 7c072a3961308e4616a4c10529019c50f8a5deba3e128165316807437256a565
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a477F.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a477F.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 84338a3f36b7c13d3c19622239c7b01643056975dc4d2f84f9807d82344a614b
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a4E36.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4E36.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 a4a0d968bbfbe8a95626eef9979be4ace70ae60d7125762ad35116d85b0cff49
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a5460.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5460.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 fffc55bdc5b574f99d1d435d73ad40d87dd7b1661ffc329a10f036a82e593d6b
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a553A.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a553A.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 128cd98016cbb724a4879b80f5fc6bcce1e65d942f92941ac85d82a0e38bca53
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a5C5F.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5C5F.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 4974bf1d76381a5d154f12f968039640eb2c37173623d29ee51475c130a691a3
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a5E24.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5E24.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 4fdd4543a1fe42277391b9dc2f6073035b0399b5ea972bfbf5a51c41422c9b7b
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a61AE.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a61AE.bat
                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                        • SHA256 5e3330c535286382e6847e67472059c717209bfdb1e39cbea644e5f0ef737b3e
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                                        • SHA256 29f41d18b516c961e717e0cd4007603496b4653cfb32fff2a35b9b08d60dd07d
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                        • SHA256 046dcf9cdc7bf2d82bf4ff72a889123d019f5e22163bfb005438a4f475172e5c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                        • SHA256 82d6df17ac3c39089d8c34f4c192c0f92bd42707fd94d7f19cad652d4838cdf6
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                                        • SHA256 d7cfc2f0fd3ac6e9753ef2000f7b42078a43dc2bdeddd58b9a2da7e13c8b29b8
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                                        • SHA256 3d648d8b0e2ed7db71f510cc74763c386fcf4bf9ccbe99174a13a28c76d3fcb9
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                                        • SHA256 24325dfce76c319e6c2967c304df02fee5b8a455266042f4d428ba3309aa3e48
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                                        • SHA256 ae6aea70ca81be6408383dbc2e7d43ae7edb0e0016479f3c41afd3f85875c92e
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                                        • SHA256 361cd51d6697ca41d591ae5502569833e2b3f962cc56ea45d59c6f400721d299
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                                        • SHA256 40f70e059ef3245a62be194fd5eeb86468896462d1c7847ffc236a4c9971c425
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                                        • SHA256 d532d70b5c099b83fa90aa5e313d71df5f2e95849f686ec3af476e2bbddd0261
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                                        • SHA256 13213d37b1afa066db8466cff6b9587e38ad27e50b7727c7057f9fbee4bd8c60
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                                        • SHA256 f80d3327eef393775b0bda22cc023a86888c460a96cda8f6be3055287bf2d2c8
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 6.0MB
                                                                                                                                                                                                                                                                                        • SHA256 681119f9effe3eef2c5c7ca0884cab758ad590514e7dc2ceeaff0354c79a8434
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                        • SHA256 de0c1ce23fbe762030a9485c8d6abce7f72217f536704c94f961f4701b76c075
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                        • SHA256 c8a7c4f6345979f3af8aa9f7b99f0fbad85b03d3020974d37dfa348c6ac0ed32
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                        • SHA256 a857b67ab96d8189689ad9e79a0ba8aec399fdff53e4ee4b4eda8997c1914cd5
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                                        • SHA256 fb7d00129ad1fb262655639ea65fa828c1ca576fca4b162d4b4a40ae9db390a4
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                                        • SHA256 e37de6a3c3d3fb4c89cd11c019c7580473d5e621df9d55e557f23ec30df3ec05
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                        • SHA256 61754b8a8938261481fb3587ba0d337f96ebb9e7facfbee01e726448a3ca947b
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-07_ff7d84741c77e17e2000183d8eb3c5c6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                        • SHA256 01b7cbaa50473156e79da7ed241ec9fa58c283cba2c19e890906bf54aead2b47
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                                                                                        • Size 9B
                                                                                                                                                                                                                                                                                        • SHA256 a2146a2532219ddb7718c93fc556ec3785b2db48e92eddc52d6d8b9e84811f8c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        memory/116-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/224-6216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/412-10238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/556-5700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/560-6231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/980-10220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/988-4991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1344-6265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1396-6275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1476-6145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1496-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1664-6255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1724-5710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1764-6221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1904-6280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1944-6241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1976-4234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2052-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2088-2938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2240-9757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2280-10226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2320-5110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2372-10244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2448-6236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2464-5690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2544-9907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2556-1870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2556-875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2556-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2556-4346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2556-9685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2688-2187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2756-6226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2844-1587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2908-6551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2936-5680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2996-9997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3012-10154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3076-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3080-6270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3148-1882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3276-9985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3288-1962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3464-4363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3488-4206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3512-10015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3532-5350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3556-6246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3736-9751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3752-5705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3864-5537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3988-1874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4000-879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4044-9745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4116-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4116-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4168-10232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4196-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4204-10009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4224-9733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4332-10094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4372-5685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4472-4728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4500-10027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4568-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4584-5936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4628-46-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4644-9991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4696-5695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4716-9739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4772-9895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4836-3072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4880-5225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4988-1365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5064-2677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5084-6260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5108-10003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5140-9763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5164-10262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5216-9769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5280-10033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5284-9775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5344-9781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5360-10039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5416-9787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5420-10046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5452-9307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5512-9793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5560-10052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5608-9799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5632-10058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5704-10064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5712-9805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5744-9913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5768-10070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5796-9811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5868-10076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5884-9817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5948-10082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5968-9823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6004-10088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6052-9829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6136-9835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6148-9841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6232-9847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6248-10100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6316-9853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6340-10106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6388-9859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6392-10112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6472-9865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6512-10118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6548-10124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6556-9871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6656-9668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6684-10130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6708-9877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6752-10160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6832-9663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6844-10136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6876-9883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7004-10142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7008-9901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7044-9889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7132-10148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7224-9925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7252-10184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7256-10166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7264-9673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7284-9689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7304-9919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7332-10178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7364-10172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7408-10256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7420-9678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7440-10021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7492-10250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7516-9943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7520-9937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7524-9694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7540-10196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7564-10190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7596-10202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7608-9931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7640-9683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7700-9699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7728-9949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7772-9040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7792-9704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7828-9955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7860-10214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7880-9709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7912-10208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7920-9967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7932-9961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7968-9715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8040-9973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8052-9721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8148-9727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8160-9979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download