Overview

overview

7

Static

static

3

2026-05-07...op.exe

windows10-2004-x64

7

2026-05-07...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/05/2026, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
  • Size 4.2MB
  • Sample260507-cbst5adw2s
  • SHA256 bbe997eb75aa3c163fbe1d77ef9243bd80c512d51c1bc67ad71e6d134e0296d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14DB.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4144
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15F4.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3372
          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5092
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a170D.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:424
              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4480
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1807.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1524
                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:3960
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1901.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4884
                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:600
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A1B.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1784
                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1752
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B05.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3520
                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3876
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C2E.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3164
                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4904
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D28.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5072
                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:992
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E22.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:244
                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:2496
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F1C.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4676
                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2424
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2025.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:960
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4248
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2110.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:416
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2684
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a220A.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4520
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2588
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2342.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:820
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4936
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a242D.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3836
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2368
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2527.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1600
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4900
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2621.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2276
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2512
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26FB.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3728
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1012
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2805.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1280
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1664
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28D0.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3416
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2628
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29BB.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:484
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:652
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A66.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1480
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4484
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B41.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4912
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3680
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CB8.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4880
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3352
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D83.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3576
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3552
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E6E.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:388
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4892
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EAC.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4328
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4976
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EEB.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4748
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1788
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F39.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4412
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4460
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F77.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4164
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3988
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FC5.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:3860
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:1468
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3004.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:1632
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4352
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3062.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:4472
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3280
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30A0.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:8
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:2888
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30EE.bat
                                                                                                                                                          72⤵
                                                                                                                                                            PID:3888
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              73⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:5084
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a312D.bat
                                                                                                                                                                74⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3864
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:3252
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a316B.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:400
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5052
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31AA.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:1072
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4764
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31E8.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                  PID:3324
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4596
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3227.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                        PID:1424
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:1440
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32A4.bat
                                                                                                                                                                                            84⤵
                                                                                                                                                                                              PID:4404
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                85⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:2120
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a339E.bat
                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4056
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a360F.bat
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:868
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5096
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3709.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4988
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37A5.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                  PID:5080
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:4808
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a388F.bat
                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a396A.bat
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                            PID:2416
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A16.bat
                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                  PID:2832
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AB2.bat
                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:3456
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B7D.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:3276
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C29.bat
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3284
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CD5.bat
                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                        PID:1584
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:3944
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DB0.bat
                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                              PID:1836
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:2020
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F94.bat
                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:2404
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1948
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4021.bat
                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4640
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a405F.bat
                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a409E.bat
                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:3104
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a410B.bat
                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:4500
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a414A.bat
                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:1068
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4198.bat
                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:1848
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:1504
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41E6.bat
                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                    PID:2804
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4234.bat
                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:3924
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42B1.bat
                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:3560
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42F0.bat
                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                    PID:3664
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a432E.bat
                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a437C.bat
                                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                                  PID:3112
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4409.bat
                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                          PID:3564
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4486.bat
                                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4444
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2144
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4541.bat
                                                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3536
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:1040
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a459F.bat
                                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3360
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a460D.bat
                                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:1004
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a466A.bat
                                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:2432
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2632
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4707.bat
                                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4745.bat
                                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3148
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47C2.bat
                                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2864
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4810.bat
                                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:564
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a485E.bat
                                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a490A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4949.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4997.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:440
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C46.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F34.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5196.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a558D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5639.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5724.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a580E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5937.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5975.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ADD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C34.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CA2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DCB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DFA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2012
                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:4324
                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:3792
                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:2964

                                                                                                                                                                                      Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            $$a14DB.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a14DB.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 be1fc5f14a9a5d38b32020148cdc9a203eda0921ebcbced96dad2bc568a75ef5
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a15F4.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a15F4.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 3fcd05d2e4d62ecb44663c2ea7d146c030a8c18fe6b5b9a9e78d3d6e81c9a8cb
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a170D.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a170D.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 843dec958bb96dae078b4043e03bd9709dfc01ac6c7e4dc6d4595cd51159c2cd
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1807.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1807.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 0b4972f241d407cc30d7847b8d2dfa2dd11952a918aeaf6f0c08254abefca616
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1901.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1901.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 50ffd610612ea52f200796ba020de1b37c824c860c69ec6cd0da8999b8d92a72
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1A1B.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1A1B.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 66f55852baf493bc7bc66c6c0801d7d8ab3e2c9d39f02f0446d1cbcabe59f90e
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1B05.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1B05.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 1b9393df08b15cff13d81e098e6eaddd0f54cf8f2922bffed73082f13fc3b197
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1C2E.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1C2E.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 ae2bfd5fee26e79fd4649dabd8a9bce237b860be296838863a7cdf888241430c
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1D28.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1D28.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 3dcb9ad231536c79f7c8dc8cd45af67aed597011eace21cc8cb52d94ab1047cc
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1E22.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1E22.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 9acf1a1b19f46ba1a8af6a6b90d4d678475669ec5d443a2f4a1a89798ab0ab31
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1F1C.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1F1C.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 0f82ab84247c8148481ed05c2026694f74d5399608f1672dfabb1296b4d93b05
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2025.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2025.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 adc1682b17be1e888fea5bab5aec8c6052ae803e9553ee5b6a44dfbea73bc720
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2110.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2110.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 ffb3a0849eb7eb1f109692707aac4d68164eda4b3a55a1914b113ad173be4f39
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a220A.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a220A.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b4cfa11ce13277d91d198fef8fb725c101ce9c5ec74b8584cb2ec307f1ac22c8
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2342.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2342.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 873964806d10958a7383d94b9137340dce5844163e1eb40212b94bff24407a8c
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a242D.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a242D.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 40b8441bf30fcb5ab7d3bbc529b4d145dd5527e9280965ad0a0958f5f90f2fd6
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2527.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2527.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 028e39e54a1f3321a66ad32fdc6e190c7acf8e9cfe7c44208dc52b2450200f0f
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2621.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2621.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 8cd816a707ce0b70c19f736c909c45ddae4a0667e6f7cc8a48dde642ae2de75a
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a26FB.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a26FB.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 90620104c1c9562175e3d7601236cfd3b914973c897c925b2fbf2c1b6701e4ad
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2805.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2805.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 2bf7d77c54d01fe8453ae3b7db9f10b0c17eb1b7427da5407c61e6195e282c7c
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a28D0.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a28D0.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 5536341212a370b736225aa49d218fa4def19f4a84f068a0536d4c7fb9091e29
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.0MB
                                                                                                                                                                                            • SHA256 da9aa93b0dc1a99ed0da6318c6485c205c1ffeab67fc96bc03414b6374ff7990
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.2MB
                                                                                                                                                                                            • SHA256 6e52152e0ac1ec243f76e19a721c9ed33190f67cd30644c6028e0ae6d1577d72
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.9MB
                                                                                                                                                                                            • SHA256 af685277f58ada6d45b3fc275925bd185215c567a03c17e0a54288e8feb924bf
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.1MB
                                                                                                                                                                                            • SHA256 d8efc04e7eea48848f3cdb5d731c5dcd8d783c513f516275a87da18ff56479b7
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.9MB
                                                                                                                                                                                            • SHA256 2d13223508e37000e352f1fc774ac4aea0e47d9d155778df9b969f257ba0bfdd
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.1MB
                                                                                                                                                                                            • SHA256 649b1d9b2d61e254ab1f358c1700bdee2b437a3e48704711f4ed45fef7694127
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.8MB
                                                                                                                                                                                            • SHA256 dfae4b857ad83e3fc51b8fcfde6dc1ac5b507a4acd4beac22c5dbd8d555ed737
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.7MB
                                                                                                                                                                                            • SHA256 23fa5e786844827fc87d1c79f2aaa83a63c1c307b27613e601ed8c5221c5682a
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.2MB
                                                                                                                                                                                            • SHA256 0134e23b80bad8ede9f77d612950517de2152228b8a499369582dc580cd20fb3
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.7MB
                                                                                                                                                                                            • SHA256 06d5e8e466dbeffdbb0cf33ef28f62d7f8d7d283bd25426bb26b94593a888ebc
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.2MB
                                                                                                                                                                                            • SHA256 df27426371b567eef5898aa9cf5bc5eedf83ba03d50b4e3c56778e176bc9c104
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.6MB
                                                                                                                                                                                            • SHA256 d054919e5902e2fdbb105d7fae3a47ce85175a57abe6a58532bf26f2b504c0ca
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.1MB
                                                                                                                                                                                            • SHA256 3f686ce80c924783ba3ff9140cc0e4580cd93cf7f90f530bb9118e6566ca98b4
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.0MB
                                                                                                                                                                                            • SHA256 4b1f2e616736db1d579699e8e1bfceba16a41e8a07b210ec23d1538177e34179
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.0MB
                                                                                                                                                                                            • SHA256 2bbd06aa7f593f6209cba599fd847e12bcffb11e19e0eb23e67747db93bca384
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.9MB
                                                                                                                                                                                            • SHA256 d3913c5c4f739bc5339d18186b6ed2e295783c0c2b2db5ae77fcb3aede3d6904
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.8MB
                                                                                                                                                                                            • SHA256 fd93663eaaba7323806fcbb598eee24f9e8ca63a2951938df7b32dc6356a3480
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.8MB
                                                                                                                                                                                            • SHA256 734221873e658f2729acc3a92812c8a79234c12dbe30b4acaebd19b7599916e8
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.7MB
                                                                                                                                                                                            • SHA256 813f015e96d03b9a0ccfebd044a80c6ae8de6c04f17e93f5b45867fc39ef79f6
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_2454e37571b2d618561c457e9192d3f2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 3.6MB
                                                                                                                                                                                            • SHA256 f4bf41070001a962d00c848e4a3f194a717c55b00d6f7034c77d1967e0901632
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-3847269522-1618051987-1942096715-1000\_desktop.ini
                                                                                                                                                                                            • Size 8B
                                                                                                                                                                                            • SHA256 5f8c21264e77abd6f223c2b2fa06edca3f659a4a7e651074de61139e9b66143f
                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            memory/564-6310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/600-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/620-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/620-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/652-311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/732-7306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/796-7924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/808-6863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/992-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1004-6285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1012-165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1040-6275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1068-5743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1080-6369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1140-10554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1440-2093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1468-1941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1504-5747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1520-6280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1612-6344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1636-6379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1664-172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1700-10524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1752-58-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1788-1929-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1948-5723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1972-5765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2020-5663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2080-5751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2088-9807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2120-2411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2132-6329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2144-6270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2196-6364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2368-141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2408-6315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2412-10579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2424-101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2436-6320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2440-10529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2444-6359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2496-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2512-158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2540-10544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2552-5895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2588-127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2620-6339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2628-177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2632-6290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2644-9203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2684-120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2856-3991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2888-1953-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2964-10549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3092-10519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3104-5735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3168-10539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3188-10569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3196-10534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3248-6374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3252-1961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3276-4682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3280-1949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3284-4941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3320-4190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3352-1627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3408-6334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3552-1917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3560-5760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3580-10171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3652-8782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3656-10559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3680-1365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3688-6305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3736-10445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3812-10589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3876-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3876-147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3928-4467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3944-5246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3960-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3976-10564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3988-1937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4056-2613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4100-10574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4108-6300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4136-6602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4144-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4144-17-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4232-5731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4248-108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4324-90-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4324-4845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4324-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4352-1945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4356-6349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4396-10584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4460-1933-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4480-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4480-116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4484-737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4500-5739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4508-7557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4524-10595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4524-10600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4556-10594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4560-5770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4588-6082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4596-1973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4624-9430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4632-3785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4764-1969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4808-3503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4892-1921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4900-151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4904-73-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4936-134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4948-8121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4972-5727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4976-1925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4988-3173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5016-6354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5052-1965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5056-5755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5084-1957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5088-6295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5092-28-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5096-2965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download