Overview

overview

7

Static

static

3

2026-05-07...op.exe

windows10-2004-x64

7

2026-05-07...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/05/2026, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
  • Size 4.2MB
  • Sample260507-cbst5adw2s
  • SHA256 bbe997eb75aa3c163fbe1d77ef9243bd80c512d51c1bc67ad71e6d134e0296d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4D2.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4276
      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5392
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6E5.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:404
          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4540
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE753.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1184
              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:748
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8CA.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4520
                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4508
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA8F.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3324
                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4464
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBE6.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1532
                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:6020
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE38.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3220
                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3168
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEED4.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5388
                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4680
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF00D.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4996
                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3996
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF145.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3104
                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4108
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2FB.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1808
                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:412
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4A1.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:808
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4004
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5CA.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5852
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2540
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF77F.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1268
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5220
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8B8.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1180
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4944
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9E1.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2016
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2936
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB29.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4656
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4304
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD1D.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6104
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:956
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF01.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2588
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:396
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3004
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5360
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D9.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:6004
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4256
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CD.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4716
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3024
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a589.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3052
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2684
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a616.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1884
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5184
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B2.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4616
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4536
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71F.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4544
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5168
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AC.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4364
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3680
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a838.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5024
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:6128
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a896.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:692
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1084
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a904.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5836
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5592
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a952.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5408
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5328
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CF.bat
                                                                                                                                  64⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1376
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2768
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C.bat
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3500
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2720
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC9.bat
                                                                                                                                          68⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2520
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:972
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB46.bat
                                                                                                                                              70⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2980
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:1156
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAD.bat
                                                                                                                                                  72⤵
                                                                                                                                                    PID:3732
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3248
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD49.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:4164
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:1912
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE6.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:2064
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:3932
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED0.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:4452
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:368
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9B.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:3964
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:540
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1018.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:3676
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:468
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1085.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:5580
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:5484
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1102.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                              PID:5272
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:4484
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11AE.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:996
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4280
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11FC.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:6096
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a124B.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:6084
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12B8.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1306.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:2992
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1383.bat
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2548
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:3880
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13F0.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:1048
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a144E.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4252
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14CB.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2872
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1539.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:924
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1577.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1792
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15F4.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                            PID:1088
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1633.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:3408
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16A0.bat
                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:2416
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16FE.bat
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:3172
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a177B.bat
                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                    PID:1908
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17C9.bat
                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2008
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5192
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1846.bat
                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                              PID:3812
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:4296
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1894.bat
                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:4728
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1911.bat
                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                          PID:3312
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                              PID:2560
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a197E.bat
                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                  PID:2136
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:5284
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19EC.bat
                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                        PID:1636
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A3A.bat
                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A98.bat
                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                        PID:4704
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AF5.bat
                                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                                                PID:5132
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B53.bat
                                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:716
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BB1.bat
                                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:1244
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1128
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BFF.bat
                                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5496
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C5D.bat
                                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CCA.bat
                                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:2932
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D18.bat
                                                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:3484
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D86.bat
                                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4736
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6100
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E41.bat
                                                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:60
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FA8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2045.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a211F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a215E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2219.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2287.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2323.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2381.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a242D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a249A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2536.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2650.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a269E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2769.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2805.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a290F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a297C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C5A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CC8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D16.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:552
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                                                              PID:4776
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5296
                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                      PID:4424
                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:4448
                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:4644

                                                                                                                                                                                    Network

                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                          Downloads

                                                                                                                                                                                          $$a2D9.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2D9.bat
                                                                                                                                                                                          • Size 775B
                                                                                                                                                                                          • SHA256 a997df24d55bac4490420bf90e0a61ec6e21b8e3bcfea8b092ff09d3d035f31e
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aD6.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD6.bat
                                                                                                                                                                                          • Size 774B
                                                                                                                                                                                          • SHA256 4e4a20359b3435f6ac988bf7e77b5622c9fbc4623184b4d4a6df6ba06d722d7e
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aE4D2.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE4D2.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 894f0b09c4eeb2695e21273a6274288d315adfbbf6295f855015f1b905fc1b82
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aE6E5.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE6E5.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 cbb5248f2e1c8b4ed752bdc1bf312ce93c74b6761ce2c7b4250352601d865325
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aE753.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE753.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 848b270470c3a488580e6a385af28a6ade77b90409feb7f8f8bf4ebc60f90a2d
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aE8CA.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE8CA.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 2cdec1c1ab94716a6f1ac47918ec5535ff7471c31a82cb1acda28fe87033c2e4
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aEA8F.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEA8F.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 d1a7308d6550067c42061d1e4b99068d92e9eeac4578a33efb84b608ed699798
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aEBE6.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEBE6.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 dbfd79e9b81adf17589ed073b938c4be6c2447b2dfa87ce1744e451779a20622
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aEE38.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEE38.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 e2f4938f69c5ef6f051b428c71631e7103b7150e7f0c74765ef5d5c5c8ee0eee
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aEED4.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEED4.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 9c015dde34a75a7576028c0467fe44af7bcc09abdebcd45775568e5c2f421016
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aF00D.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF00D.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 a12b8da727ab9b21c28c23415e455662b64e0b4de1788326fade23e629fbc6e3
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aF145.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF145.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 f51877ec60ad90fcee366b653c6fee1e8187aefeee259fec85741d2f05209864
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aF2FB.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF2FB.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 a8810176b2ce7b20b318e3e0426c5cc515adbfa852b734c7b3963a9d0596d502
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aF4A1.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF4A1.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 55ba05279172f86005bc39a7f23791148602b2234222aca2f73c86399c926e38
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aF5CA.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF5CA.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 850f02559cc2b2f85b0c0dcc7159923b7e94c303fec929cc53016a3bd9bf1688
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aF77F.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF77F.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 e0c1d9a3050e1f3a5d4bcda8b422fc386a6f4637712782c847e19f2ff574e012
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aF8B8.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF8B8.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 01562024987403e6a8774c2625c0dfa7c9797837417748fbdbaa20b91496f63b
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aF9E1.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF9E1.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 71e35cdddb4e62c1cd4d0784d68378fdbd5d27d1a7e2e14c362ee3334c4eb3c3
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aFB29.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aFB29.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 b12cfb807526a386b9f534e93133d8a2ee9bd0f07362c733bb759da417574d44
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aFD1D.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aFD1D.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 df4c9b30f5a3833ba9cded302ac435ec913963d008bccf6a625f4248d66a05cd
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          $$aFF01.bat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aFF01.bat
                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                          • SHA256 0a0f5df3d5e5a3f8a23d1efb36622bd8a994e4817870ee165266417246b252b8
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.0MB
                                                                                                                                                                                          • SHA256 4b1f2e616736db1d579699e8e1bfceba16a41e8a07b210ec23d1538177e34179
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.7MB
                                                                                                                                                                                          • SHA256 06d5e8e466dbeffdbb0cf33ef28f62d7f8d7d283bd25426bb26b94593a888ebc
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.6MB
                                                                                                                                                                                          • SHA256 f4bf41070001a962d00c848e4a3f194a717c55b00d6f7034c77d1967e0901632
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.6MB
                                                                                                                                                                                          • SHA256 d054919e5902e2fdbb105d7fae3a47ce85175a57abe6a58532bf26f2b504c0ca
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.2MB
                                                                                                                                                                                          • SHA256 0134e23b80bad8ede9f77d612950517de2152228b8a499369582dc580cd20fb3
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.1MB
                                                                                                                                                                                          • SHA256 d8efc04e7eea48848f3cdb5d731c5dcd8d783c513f516275a87da18ff56479b7
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.2MB
                                                                                                                                                                                          • SHA256 6e52152e0ac1ec243f76e19a721c9ed33190f67cd30644c6028e0ae6d1577d72
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.0MB
                                                                                                                                                                                          • SHA256 2bbd06aa7f593f6209cba599fd847e12bcffb11e19e0eb23e67747db93bca384
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.2MB
                                                                                                                                                                                          • SHA256 df27426371b567eef5898aa9cf5bc5eedf83ba03d50b4e3c56778e176bc9c104
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.1MB
                                                                                                                                                                                          • SHA256 649b1d9b2d61e254ab1f358c1700bdee2b437a3e48704711f4ed45fef7694127
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.9MB
                                                                                                                                                                                          • SHA256 d3913c5c4f739bc5339d18186b6ed2e295783c0c2b2db5ae77fcb3aede3d6904
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.1MB
                                                                                                                                                                                          • SHA256 3f686ce80c924783ba3ff9140cc0e4580cd93cf7f90f530bb9118e6566ca98b4
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 4.0MB
                                                                                                                                                                                          • SHA256 da9aa93b0dc1a99ed0da6318c6485c205c1ffeab67fc96bc03414b6374ff7990
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.8MB
                                                                                                                                                                                          • SHA256 fd93663eaaba7323806fcbb598eee24f9e8ca63a2951938df7b32dc6356a3480
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.9MB
                                                                                                                                                                                          • SHA256 af685277f58ada6d45b3fc275925bd185215c567a03c17e0a54288e8feb924bf
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.8MB
                                                                                                                                                                                          • SHA256 734221873e658f2729acc3a92812c8a79234c12dbe30b4acaebd19b7599916e8
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.9MB
                                                                                                                                                                                          • SHA256 2d13223508e37000e352f1fc774ac4aea0e47d9d155778df9b969f257ba0bfdd
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.7MB
                                                                                                                                                                                          • SHA256 813f015e96d03b9a0ccfebd044a80c6ae8de6c04f17e93f5b45867fc39ef79f6
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.8MB
                                                                                                                                                                                          • SHA256 dfae4b857ad83e3fc51b8fcfde6dc1ac5b507a4acd4beac22c5dbd8d555ed737
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                          • Size 3.7MB
                                                                                                                                                                                          • SHA256 23fa5e786844827fc87d1c79f2aaa83a63c1c307b27613e601ed8c5221c5682a
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Logo1_.exe
                                                                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          _desktop.ini
                                                                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-721190819-434563495-2007910846-1000\_desktop.ini
                                                                                                                                                                                          • Size 8B
                                                                                                                                                                                          • SHA256 5f8c21264e77abd6f223c2b2fa06edca3f659a4a7e651074de61139e9b66143f
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          memory/60-1461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/316-1581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/368-1225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/396-629-0x0000000001FC0000-0x000000000207F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/396-628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/412-115-0x0000000001FA0000-0x000000000205F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/412-114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/468-1237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/540-1231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/552-1214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/552-1274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/716-1407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/748-37-0x0000000002020000-0x00000000020DF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/748-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/776-1701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/828-1665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/924-1311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/956-351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/956-352-0x0000000001F40000-0x0000000001FFF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/972-1185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1048-1292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1084-1156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1084-1157-0x0000000001F00000-0x0000000001FBF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1096-1689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1128-1413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1156-1193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1332-1551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1404-1659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1416-1599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1504-1635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1720-1611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1860-1677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/1912-1208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2416-1335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2432-1431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2496-1653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2524-1521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2532-1647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2540-133-0x0000000001F70000-0x000000000202F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2540-132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2560-1371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2684-1126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2684-1127-0x0000000001F20000-0x0000000001FDF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2720-1179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2724-1708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2724-1702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2768-1173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2928-1347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2936-156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2936-157-0x00000000005C0000-0x000000000067F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2992-1280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3024-1121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3024-1122-0x0000000001F90000-0x000000000204F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3124-1587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3168-77-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3168-78-0x0000000001F30000-0x0000000001FEF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3172-1341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3224-1563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3248-1199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3280-1267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3292-1497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3308-1401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3316-1605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3392-1273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3396-1509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3408-1329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3484-1437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3680-1147-0x0000000001FB0000-0x000000000206F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3680-1146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3696-1557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3744-1449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3880-1286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3932-1218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3992-1515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3996-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/3996-94-0x0000000001FE0000-0x000000000209F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4004-123-0x0000000001F80000-0x000000000203F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4004-122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4036-1683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4108-107-0x0000000001FB0000-0x000000000206F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4108-106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4132-1395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4204-10-0x0000000001F80000-0x000000000203F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4204-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4204-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4220-1317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4252-1298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4256-1117-0x0000000001F90000-0x000000000204F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4256-1116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4280-1255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4288-1305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4296-1359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4304-234-0x0000000001FA0000-0x000000000205F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4304-233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4336-1533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4408-1479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4424-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4424-1207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4424-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4436-1389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4464-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4464-55-0x0000000002010000-0x00000000020CF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4484-1249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4504-1641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4508-46-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4508-47-0x0000000001F50000-0x000000000200F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4536-1137-0x0000000002030000-0x00000000020EF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4536-1136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4540-28-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4540-29-0x0000000001F70000-0x000000000202F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4596-1323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4632-1491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4660-1473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4680-85-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4680-86-0x0000000001FB0000-0x000000000206F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4728-1365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4876-1527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4944-149-0x00000000004D0000-0x000000000058F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4944-148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5124-1629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5152-1575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5160-1545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5168-1141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5168-1142-0x0000000000680000-0x000000000073F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5184-1132-0x0000000001F80000-0x000000000203F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5184-1131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5192-1353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5220-141-0x00000000006A0000-0x000000000075F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5220-140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5280-1617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5284-1377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5328-1166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5328-1167-0x0000000001FA0000-0x000000000205F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5352-1485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5360-903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5360-904-0x0000000000590000-0x000000000064F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5392-21-0x00000000005B0000-0x000000000066F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5392-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5428-1539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5484-1243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5496-1419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5512-1425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5516-1569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5552-1623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5592-1162-0x0000000000700000-0x00000000007BF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5592-1161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5656-1467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5664-1695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5724-1593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5804-1671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5972-1455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6016-1383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6020-70-0x0000000002040000-0x00000000020FF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6020-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6024-1503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6096-1261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6100-1443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6128-1151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6128-1152-0x0000000001F50000-0x000000000200F000-memory.dmp
                                                                                                                                                                                          Download