Overview

overview

7

Static

static

3

2026-10-15...op.exe

windows10-2004-x64

7

2026-10-15...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/10/2026, 23:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
  • Size 4.8MB
  • Sample261016-3egt5sys6l
  • SHA256 65dfa64474bfd1bb003584a2833477c6824fdd57627b9e4077edd4bf3a094e53
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE238.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3448
      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4F7.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1784
          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:260
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE891.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5032
              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2580
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA95.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2124
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5484
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECD7.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5068
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:6052
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF96.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3620
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:5036
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF207.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4480
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4472
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4B7.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4664
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4816
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF728.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3560
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3344
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF96A.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4040
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4768
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE1D.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1820
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:3392
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31E.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4060
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:860
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a522.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2332
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2364
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13E7.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2560
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1240
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16B6.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3068
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1380
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1907.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3056
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1532
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D8C.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4556
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2528
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F41.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4156
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4312
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2193.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4404
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2996
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23D5.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5856
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4364
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BE4.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4316
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2876
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D4B.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2232
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2316
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E16.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2336
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4984
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F2F.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3324
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2836
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FFA.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2476
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2600
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30E5.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4124
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:6084
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31B0.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5684
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1536
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32E8.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4228
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:432
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33C3.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:204
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5000
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a347F.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5272
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4732
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a352B.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4700
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1276
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35E6.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:576
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4032
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3692.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:4544
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5584
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a373E.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:4108
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4692
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37EA.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:5372
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:2428
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3896.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:4728
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:1512
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3932.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:5380
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:5312
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39DE.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2820
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:252
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A8A.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:5160
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:688
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BA3.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:2544
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:2616
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C3F.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:2604
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4348
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D0A.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:2792
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:4132
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DA6.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:4116
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:2084
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E52.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:5112
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EFE.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1096
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FBA.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                          PID:1948
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4066.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:244
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2096
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4102.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:3212
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41AE.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:3044
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:940
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4269.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:2660
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:1628
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4354.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                    PID:4676
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a441F.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4160
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5872
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DA.bat
                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2756
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45A5.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3252
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4690.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                      PID:2456
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2420
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a474B.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:3004
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4826.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48D2.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:1496
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4056
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a498D.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:5500
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A68.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:2040
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B24.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                PID:1560
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:2480
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C0E.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:4164
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CD9.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2468
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D66.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1140
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                PID:2404
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E02.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:5044
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E9E.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:4424
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                            PID:2728
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3A.bat
                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:4332
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:1684
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FD7.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:2308
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5092.bat
                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:5540
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:5028
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a512E.bat
                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                  PID:1508
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51EA.bat
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                      PID:1384
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                          PID:2024
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5286.bat
                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:5908
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                PID:5508
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5322.bat
                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:2032
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53DE.bat
                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4036
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:928
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a548A.bat
                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1300
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5536.bat
                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:296
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5610.bat
                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:5528
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56AD.bat
                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:3696
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5749.bat
                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57F5.bat
                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5852
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:5156
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58A1.bat
                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:5732
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a593D.bat
                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BCD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:568
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ECB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6071.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a611D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6265.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6320.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6478.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6514.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a661E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6727.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6831.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6979.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A25.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7011.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a709D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a711A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7262.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a736C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7408.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7522.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a764A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7773.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:2912
                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:3316
                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:1144

                                                                                                                                                                  Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                        Reconnaissance

                                                                                                                                                                        Resource Development

                                                                                                                                                                        Initial Access

                                                                                                                                                                        Execution

                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                        1
                                                                                                                                                                        T1059

                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                        1
                                                                                                                                                                        T1059.003

                                                                                                                                                                        Persistence

                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1547

                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                        1
                                                                                                                                                                        T1547.001

                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1547

                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                        1
                                                                                                                                                                        T1547.001

                                                                                                                                                                        Defense Evasion

                                                                                                                                                                        Credential Access

                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                        1
                                                                                                                                                                        T1555

                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                        1
                                                                                                                                                                        T1555.003

                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                        1
                                                                                                                                                                        T1552

                                                                                                                                                                        Credentials In Files

                                                                                                                                                                        1
                                                                                                                                                                        T1552.001

                                                                                                                                                                        Discovery

                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1120

                                                                                                                                                                        Query Registry

                                                                                                                                                                        1
                                                                                                                                                                        T1012

                                                                                                                                                                        System Information Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1082

                                                                                                                                                                        System Location Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1614

                                                                                                                                                                        System Language Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1614.001

                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1016

                                                                                                                                                                        Lateral Movement

                                                                                                                                                                        Collection

                                                                                                                                                                        Data from Local System

                                                                                                                                                                        1
                                                                                                                                                                        T1005

                                                                                                                                                                        Command and Control

                                                                                                                                                                        Exfiltration

                                                                                                                                                                        Impact

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        $$a13E7.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a13E7.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 73727047c48fcfea8ddb317aaae3922ecc4307e08b09d6d647cfad152589ab76
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a16B6.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a16B6.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 963e1c6a99ebe94d9eeb52e277d202353f935a217a0e9f1a8322fd8cd28d5b15
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a1907.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1907.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 7106002d047ffd2e67e946b33112f5429d83dcb006c26b2d70a7b43176d9029a
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a1D8C.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1D8C.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 b7c9a79ab854dd748b11f452fabfdff73bb2327c146529b687d193a5b527cbd0
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a1F41.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1F41.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 05d09ba3bc66732416ca70a7df09a25b25e15be54fbbb771ed09397702f91610
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a2193.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2193.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 f957e93415fb90d15678d3126b99f0837246393b59bf5b3ce07da9e5c1a1db9c
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a23D5.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a23D5.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 6a80844c01d6e0db2995057fa20fe631493cce7dcad2105491ba967b35c6a80b
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a2BE4.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2BE4.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 872e5aa99d71acae40d25e7f3e5359c01244e7fa125a3f26ac57cbaabace5aa8
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a31E.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a31E.bat
                                                                                                                                                                        • Size 775B
                                                                                                                                                                        • SHA256 4faa9e7e9e458e10198237038fc4115b4c9b02a6742334df6b49664a0286b67d
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$a522.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a522.bat
                                                                                                                                                                        • Size 775B
                                                                                                                                                                        • SHA256 5f0f3ba272a50c20cbdbeaf070606f3345b894c98bcb1ea328f3532b2adf9b7d
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aE238.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE238.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 b8c94d0309dae7fd4627db4f4f2c4d2864b95da122f6ea8a05e2eb1dd9577616
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aE4F7.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE4F7.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 40916c5e8c20355bcb575a00c954b25a24d8728a651f110e4acb9c7136fbe63a
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aE891.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE891.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 9173ceff72131f7891ececdef9c7da17e7a264487181f41e8a596660e194cb08
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aEA95.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aEA95.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 1e8f4689a1c18faba1561905223c7ce89e2a9aeef46ff245e73e1ea828a44a19
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aECD7.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aECD7.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 59f6b886c10344a3d7a8604725837010cd16339adb571291c563a40c3b7c139a
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aEF96.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aEF96.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 befa677d99d21221186aa49c4b862ce4c1056701ff793befd7f6ddadac205965
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aF207.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF207.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 7dbb6a2c05e9294c017336493460bbcbd6bb602c1b497ba234bc2afae07c069f
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aF4B7.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF4B7.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 3f0454844b5fc0840120a1235b9a12ecbe804e563882832bae823037c49ec579
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aF728.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF728.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 7072684a4ea8107a32004b41a6f9b31b93034404cdd6f9149fef25fec1593a02
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aF96A.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF96A.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 17c440d524438f74dea253cc9e3df55fd8868a82b40b6008cd47084092e3e2a6
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        $$aFE1D.bat
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aFE1D.bat
                                                                                                                                                                        • Size 776B
                                                                                                                                                                        • SHA256 80e25eff8c3e7fbd6c9aa47c10545d983b04f4be79839278c4f23fe973f46c67
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                        • SHA256 af8acbeb2a9a480624443c6589ab24372301bccffab93246cd1042defd54a031
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                        • SHA256 6f414d306793a05900c51ba18c42688792f73c7dc07731437227e58806149b8d
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                        • SHA256 08b9d61d083c9fa43d59a62202af696aad0c6940f269ad248417e0ed1ec1577f
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                        • SHA256 a12a5a3d7f3c70586a27d587821e7fa4d332851caad430b113be6b4381c68ab3
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.3MB
                                                                                                                                                                        • SHA256 545a25558e938a69519618da9230425fd402b4a3ea6f878e8180650690e9e363
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.3MB
                                                                                                                                                                        • SHA256 f42e9103de3d912af59b5c5d49caee7ab4f396df71e587c2c839aa7a45a85d96
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.2MB
                                                                                                                                                                        • SHA256 4498de7d3cf9a33c688b4cbf4fb744bfffa5351736a0189cfe289e05b20f640b
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.3MB
                                                                                                                                                                        • SHA256 33f0c6e0876188c7ba4c54b35d04d8e0191eb88cb1d410c7dff18d975df4d0d8
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.2MB
                                                                                                                                                                        • SHA256 7c8109b0796012d51718db303effe50777b7a9874a099ef5fbf0e66e22aef841
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.2MB
                                                                                                                                                                        • SHA256 22352b88b49eeea751fc6890a821914dcff92a54d92c95f0c766237b021b25ac
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.2MB
                                                                                                                                                                        • SHA256 7c2d5476e863504123ab55533a3953bc9b1df129be8e3a3387944f5ed4f11b8a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                        • SHA256 4d4557476101b54546520f230f5e8ec8c7bb873ee127e0d1d93d96d3e790c5d0
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                        • SHA256 bd29740203a5f77e56c4cf0e690a84f5b41d801985f5cc46c8e5db6459c11538
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                        • SHA256 3eadc7c5109f4657f623021d56bdccb710f883fbea4a6433645682040665cfd5
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                        • SHA256 f012f6c81d10acd97f1e845d0210bc5a0cb437bd8c2922e2ee0e8dab5fc75d64
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.6MB
                                                                                                                                                                        • SHA256 7196fd94dfd17ca3961e7b74dcb81b60e7d7741739bdbbc767657a9575dea841
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                        • SHA256 4e092c98c21249cc4984b808e6fed398a228e9e04c131772831b85b47bc221ae
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.5MB
                                                                                                                                                                        • SHA256 2c4aadc00ee9f16adbdc1913c589458f9fa606c798647486af18c543fa76a573
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                        • SHA256 8489e41f06fb9b09d3217802aa0c7ae221509aead6f6b71f59b3a83554fb69fa
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_0cdc9301da11426d6ff3bde92f743c17_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                        • Size 4.4MB
                                                                                                                                                                        • SHA256 02143b823eedf08acb6de6b302d816f580ced0c51789e926dd0bbd5bf2815cd9
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                        • Size 32KB
                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        _desktop.ini
                                                                                                                                                                        • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                        • Size 10B
                                                                                                                                                                        • SHA256 63e88b8d19d69b081af987c4000305aa56469cdb3211e8600d1b196ed0479546
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        memory/252-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/260-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/432-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/568-8719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/688-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/832-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/860-1893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/928-8606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/940-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1176-8922-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1232-8782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1240-5615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1240-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1276-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1284-9034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1380-5624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-8901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1456-8887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1508-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1512-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1532-6094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1536-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1564-8880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1628-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1648-8754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1684-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1808-8761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1876-8627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1880-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2024-8585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2040-8510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2080-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2084-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2096-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2292-8985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2308-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2316-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2360-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2364-5201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2380-9006-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2388-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2404-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2420-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2428-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2480-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2528-6103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2552-8613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2580-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2600-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2616-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2648-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2672-8789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2708-8817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2724-8873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2728-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2772-8543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2836-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2840-8712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2852-8831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2876-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2912-523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2912-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2912-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2912-2629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2924-8852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2996-6125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3020-8943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3024-8529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3112-9042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3112-9036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3176-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3344-111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3392-1884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3396-8824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3548-8845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3616-8726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3704-8971-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3828-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3888-8859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3968-8705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3980-8810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4032-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4056-8498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4132-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4136-8929-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4168-8426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4192-8894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4212-8803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4312-6116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4324-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4348-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4364-8265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4384-8908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4408-8978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4472-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4492-8663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4508-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4572-8775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4596-9013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4612-8915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4636-8999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4668-9020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4680-8747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4692-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4732-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4736-8492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4760-9027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4768-883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4796-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4796-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4816-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4888-8866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4896-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4948-8936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4968-8957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4984-8285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5000-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5028-8571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5036-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5112-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5116-8634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5132-8992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5156-8649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5196-8838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5312-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5360-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5376-8620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5384-8796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5416-8691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5464-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5484-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5492-8670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5500-8504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5508-8592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5520-8950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5584-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5624-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5628-8733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5696-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5844-8486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/5872-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/6028-8964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/6052-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/6084-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                        Download