Overview

overview

7

Static

static

3

2026-08-13...op.exe

windows10-2004-x64

7

2026-08-13...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 02:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
  • Size 5.2MB
  • Sample260813-dbcctazfnb
  • SHA256 d30e71250eab76599102a627ea03fa858c3e58bd96995b1071ec23f92f84d119
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DCF.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5656
      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22EF.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2460
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a260C.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4872
              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2616
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2929.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1188
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4688
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BC9.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1360
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2088
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F05.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:256
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2924
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31A5.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5408
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3696
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34A3.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3948
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5172
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FCE.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2256
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5988
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4210.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:752
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:592
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4675.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2096
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2752
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F4F.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1484
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4456
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CBC.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4532
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5736
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EB0.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3768
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1108
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a640F.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4776
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3488
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65F4.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4412
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5072
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69DC.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4816
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2352
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2184
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1960
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1548
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5132
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a799B.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5204
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2724
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C4A.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2140
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5868
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EFA.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1104
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5152
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8032.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4876
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:672
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a818A.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1364
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2952
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1036
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1940
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a839D.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4668
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3512
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3476
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1932
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85FF.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5772
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4856
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8737.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3324
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4940
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a888F.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2320
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4220
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89C8.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:5344
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4376
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B2F.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:468
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:5924
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C48.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:4692
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:5948
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D71.bat
                                                                                                                                          68⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4724
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4064
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EB9.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:3380
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:5812
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9001.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:3828
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3340
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9169.bat
                                                                                                                                                      74⤵
                                                                                                                                                        PID:4124
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:3636
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92D0.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1512
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3452
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F9.bat
                                                                                                                                                                78⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:6096
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:1968
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9522.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                      PID:5844
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:4164
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a962B.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                            PID:820
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:4980
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9745.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                  PID:4188
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:3560
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:1476
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:5748
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9939.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                            PID:4708
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:3172
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A62.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:4140
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2148
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C84.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4444
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2992
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                PID:1672
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:1184
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E78.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                      PID:972
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F72.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                            PID:1208
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:3552
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                  PID:5576
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1B5.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                        PID:4696
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:1248
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:4092
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1500
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3C8.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:4572
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:5912
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:5316
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA629.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:1120
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA704.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:2548
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:1180
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA946.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA50.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4292
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB2A.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:4808
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:3200
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC05.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:1164
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACD0.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                      PID:5164
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:5412
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADBB.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:2432
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE86.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                PID:296
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF70.bat
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:3676
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:408
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB03B.bat
                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                            PID:5040
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:416
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB106.bat
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:1588
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                    PID:3832
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1D2.bat
                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:1236
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:4468
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB29D.bat
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB358.bat
                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB414.bat
                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:3312
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                          PID:3876
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4CF.bat
                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5080
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2808
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB646.bat
                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:2400
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:5980
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3048
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7DC.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5088
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2908
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:4248
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB953.bat
                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4240
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA2E.bat
                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4936
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4732
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB09.bat
                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5884
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:252
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC51.bat
                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC097.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC152.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC588.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC644.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC78C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC828.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC961.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCEB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD056.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:52
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD102.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD19E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD21B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD363.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD400.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD48C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD528.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD642.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD78A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD826.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD901.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE015.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE12F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE257.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE361.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE47A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE574.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE68E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2000
                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates a file in the Startup directory
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:3436
                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:3904
                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:1668

                                                                                                                                                                                      Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            $$a1DCF.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1DCF.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 10391fd403120633737035018f79fa5255f26db41dcfaeb791b6a2bbb3628d7d
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a22EF.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a22EF.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 2343955a6b6ce8e09a7a70e29510c29a5503d7825b91e53b3c36572d20d23e7f
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a260C.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a260C.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 d6208791da7b14e56fc6e0e243b9c4f2e45a1bdb4ae2ae6c7f4c79afad7094d5
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2929.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2929.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 ed860a3406986fb2728c62430a5bce273ce94481212d10e68fc48cc50d50ed1b
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2BC9.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2BC9.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 94439c3cbb706b6a59ee20aac6c8444b277c59abfacdc4c6f66871b8d34c1e21
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2F05.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2F05.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 20907369262749cd8cc0aff2195277c385051a0316b84784247a74dd93291149
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a31A5.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a31A5.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 637830736f831b84cc4d4511f6a5308175d1fef4db7eb40f085c14f49abb9361
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a34A3.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a34A3.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 5c93f703ececde906907fbf602ddbc193010b3e7cdf320278cf06d92380ec74d
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a3FCE.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3FCE.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 04d28db70f3c6cd7016321dd1b3bd6815947eb545532691f41f2f59f32fd16bb
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a4210.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4210.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 e7531dc163afb41d03c220a681d72863b3ac4ba7c73f5588c80abb0947934989
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a4675.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4675.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b18129c1d56caae12568e2c897e82b9be4a075b83e33ea58c582f458ffe128d4
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a4F4F.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4F4F.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 f7fb050ddda528ace7173cdf8bdad9f8a379cf4ae2f46062c9cd877cb4d1f9ea
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a5CBC.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5CBC.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 27cee47718b7cff797e200b7330b912510def017a882aeeda4433a98723937ae
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a5EB0.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5EB0.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 835e9f31080e1172d425ea84c6f100cd5d0860a6219db8c294b84dcc858f00f0
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a640F.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a640F.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 d8fcdfc73a724e16febea06cfaacd9d49cfa08baae1625cb039d9984c2a7ccce
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a65F4.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a65F4.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 baa56b9f27960536a7e87a2f69b1a566f284a99654a5b1fcc4f433400e588593
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a69DC.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a69DC.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 638c8086eccb2fbd140425823175b99e214bc820e818043adead98be88c7dae0
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a7371.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 29352e01cfdf3a73d5f49cf2a91805df0c8d827660bb432bde47d581e1ff305a
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a768E.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 3442e3102250257c19bc9ad9e1a5ca511a469e58cb3b909903c66bd121496554
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a799B.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a799B.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 593ef36293acb006aa652ada5c4f070a95678d6204040ca044765e4ea8d43f60
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a7C4A.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7C4A.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 5b8aaa8ebb171e33e404d902d2277ffbc57c1573d4b2f1ab281afb79d9baa19c
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 b091ac58f75e501f2e2b90abcf727d66226e1f0b8d15c5cd2f9c27c952576590
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 2b69092514362948deeefaad180e253c47705e4fc898b2d8de68da99ba844171
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 9ebed0650900172bc35a358851b98fad63a7b18a2ace91a3dafdedb1edf90256
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 5fb856a7fd4835cdf53a1ca9c66dfb08a9ecc37475889156f5b316c46c95b3ff
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 39131283660397c37b149840a9e9d88630f138947bc6a428e3c701a47a7cc2ed
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 d879d62934266cc2849dd176575713db48e9ee3939a247b19257e3d9c432784f
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 f6006b6edfa6802c0f1e5f7036a752f5d1c895f05d6a4d7627d0d42267ba72a8
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 fde89b8ec77aecebf75440d4d5736458a3e495d3589603e1e89e776f94195133
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 23feeb64131b36557e24be6a4b1419bc7e293fca38fd7e2d25f7e77ff338e585
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 3786ed457815bd6f9af3a8932a5ac58bfebb8b5544e270851a73dfcc0873beae
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.5MB
                                                                                                                                                                                            • SHA256 2a0251aaa1adf56e66b105dda9fced24094a2e8b0e4dfaca5aa6542d01688647
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                            • SHA256 58d6df2ac896d0bd51d1b3fdc0ba73ad91a4437ef416ca1f62f2df6bb05aede3
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                            • SHA256 fe5f4298849806224f286d2f4fd8073a9be856a3cdda5877173c476ce0c37977
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                            • SHA256 d6fce2baa0c414627792151ce4705c41029d45c98aa05fa30a1c4b33ce233d50
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                            • SHA256 cb02a0fd0001675ac1457c93c29cec0d0c683a99905a2d612f3acf3c20f27921
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                            • SHA256 093de2cd0f0c0200c0f33f0e43c8b88d96bac5493744c30141130291e53fe795
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                            • SHA256 8b406ac2a826f81e2f24b7908ad37a552dffa464d4d9e97a995f4219d39513a0
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 8e62c855998a4672c25dc36f8ab463aabc10d2ab029727e2bf0910ff2ca43365
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                            • SHA256 4c1048704c564fc88462a78f3f576d34fa2151999a07cfbd60406b6a3fd39966
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_f5595688ac254c4dbd803760b0603c59_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 8a06619c5522f69e4a5b35b9c0aa2f8007076e335ec6d2b427603d2cac7167eb
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-3989226554-2204910950-1522900112-1000\_desktop.ini
                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                            • SHA256 2ef572b16408784c924887853b6865cbb5f2ade2f877f17ee91c4af1bf1cff51
                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            memory/52-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/408-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/416-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/480-8907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/592-2184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/672-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/716-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/940-8648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1108-6062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1180-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1184-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1216-8540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1248-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1264-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1340-8901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1368-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1392-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1500-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1716-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1716-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1720-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1752-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1848-8913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1932-8246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1940-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1956-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1960-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1960-8247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1968-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1992-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2012-8726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2016-8732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2020-8937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2088-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2148-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2232-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2268-8552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2280-8606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2340-8876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2352-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2400-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2412-8666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2432-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2460-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2520-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2560-8889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2600-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2616-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2720-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2724-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2736-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2752-3223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2876-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2924-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2952-8231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2972-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2988-8870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2992-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3048-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3156-8714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3172-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3200-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3272-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3340-8292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3388-8834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3432-8840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3436-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3436-2023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3436-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3436-6655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3436-1075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3452-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3452-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3488-6074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3512-8241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3552-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3556-8925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3560-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3588-8708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3612-8582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3636-8297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3644-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3664-8828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3696-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3832-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3876-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4064-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4116-8864-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4164-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4220-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4224-8780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4228-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4244-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4248-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4276-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4292-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4316-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4376-8267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4456-5585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4468-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4488-8792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4544-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4560-8810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4624-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4640-8600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4644-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4688-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4716-8931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4732-8528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4744-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4812-8594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4828-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4856-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4892-8858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4900-8750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4916-8756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4940-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4960-8534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4968-8816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4980-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4988-8798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5036-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5072-6082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5080-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5116-8852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5132-8202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5148-8804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5152-8221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5172-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5316-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5324-8938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5324-8944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5412-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5416-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5476-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5500-8738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5512-8919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5520-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5660-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5692-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5696-8696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5700-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5736-5593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5748-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5760-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5788-8846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5812-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5860-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5868-8216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5912-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5924-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5936-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5948-8277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5960-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5976-8822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5988-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6072-8882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6088-8895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download