Overview

overview

7

Static

static

3

2026-08-14...op.exe

windows10-2004-x64

7

2026-08-14...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
  • Size 4.6MB
  • Sample260814-e88mysvwcy
  • SHA256 9c9c7fce5701bde6412db24b201a2c5cd32239e270752b00cc281f565c024a62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23D.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47F.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2372
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FA.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2920
              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2560
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA9.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1372
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3168
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD59.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1648
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:648
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1028.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:216
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4596
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12F6.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3892
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1712
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16BF.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1000
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:3100
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1817.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4056
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:696
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A88.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:1628
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:944
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CF9.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2160
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:3228
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2362.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2648
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3324
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a266F.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2964
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1284
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2788.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:820
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3504
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A86.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3432
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2284
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F0A.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4416
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3824
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3285.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1296
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2008
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3544.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3864
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2452
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39F7.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4148
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:940
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C68.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3604
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4588
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F37.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2652
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2852
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a465B.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1740
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2292
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47C2.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4876
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3204
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AFE.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3308
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1252
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BC9.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4860
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4640
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C85.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1644
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3028
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D21.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:644
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2408
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DBD.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2200
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2412
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E4A.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1292
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1280
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F63.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2032
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3296
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a506D.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4584
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:2844
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5176.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:3772
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2520
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5290.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4536
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4572
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a534B.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:4528
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2216
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5407.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:3984
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1704
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54F1.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:2376
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4116
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55AD.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:3484
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4180
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5649.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:2704
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4784
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56D5.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:4228
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:1464
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5791.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4824
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4344
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a581E.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4924
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4740
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58C9.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4200
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4932
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5975.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5032
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:2068
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A50.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                            PID:2368
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:3676
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D4E.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:3044
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a604B.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                        PID:5100
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:1856
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65E9.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                              PID:1344
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a681B.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                    PID:4756
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B48.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:3024
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CAF.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:2112
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:4648
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D8A.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:1364
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:3612
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E45.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:888
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6ED2.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1940
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FCC.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                  PID:3720
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2400
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7097.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4544
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7124.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:3796
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71D0.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                  PID:4464
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a728B.bat
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2012
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4288
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7356.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:816
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7412.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:3924
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a751B.bat
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4764
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75F6.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:464
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76E1.bat
                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77AC.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:848
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7867.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:4828
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78F4.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:2328
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7980.bat
                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                  PID:3836
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A9A.bat
                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:1880
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                        PID:3736
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B55.bat
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C11.bat
                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                PID:896
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:3944
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CCC.bat
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:3144
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:3284
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E05.bat
                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                          PID:2732
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:2764
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ED0.bat
                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                PID:2644
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4036
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F9B.bat
                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4600
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:2864
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8066.bat
                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:1884
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:2184
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8102.bat
                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81BE.bat
                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2308
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8279.bat
                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:3896
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1112
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8335.bat
                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:3268
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83E1.bat
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2604
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84CB.bat
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:2552
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8577.bat
                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8681.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a872C.bat
                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8826.bat
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a899D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DE3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9045.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a914E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9361.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a940D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9555.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9630.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a970B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9882.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a996C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A37.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D54.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ECB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA062.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA19A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA227.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA42A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA563.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA60F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA757.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3704
                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                      2⤵
                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Enumerates connected drives
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:2128
                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                        3⤵
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:3356
                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                          4⤵
                                                                                                                                            PID:4744

                                                                                                                                    Network

                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          $$a1028.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a1028.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 eb1d2537cf60cfcb9a2a373923830e4236b1d2865c68dfb58d81b9209ca901ab
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a12F6.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a12F6.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 5e53216c2769d456346b65a9f5d0adc093d7e86c399c9d9afa7116cc206edaf2
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a16BF.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a16BF.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 d57d637f64d801d55b228893c44a9e4bfca8913ccde4ce09ac27117fd4a7e55a
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a1817.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a1817.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 161b06a3116f7ac534c79828ba63d2745627cf3ebcf9a7efd7f28a894accfff1
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a1A88.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a1A88.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 4a97de6e0e6547470460861be2289c273bf028220fbebc8afe67a30eaead0eaa
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a1CF9.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a1CF9.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 0cb28d993900b0d1360faa641f594592dc5137b7b33814d332bc8c47e36c6640
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a2362.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2362.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 c4b8f65ba6258dcb162226d60b1637c0f90b197f93e0b820903dc345240ed99c
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a23D.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a23D.bat
                                                                                                                                          • Size 775B
                                                                                                                                          • SHA256 5956dff8d0b57cb58868960c78f765f8425a4634db685e2c848982c492158ffd
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a266F.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a266F.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 a3af79c05fb74740b9d0453fa30937f774706f06a38f1d91a738e17fe9cdab4e
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a2788.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2788.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 a91605e74bddc84a4cee31f2fa9093351a42b0417a833171d0b1fd3286639e63
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a2A86.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2A86.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 e0bc17c0c28b51910c7c544f2965e7b4f3415ca05ee881b2d4c771436e8d668c
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a2F0A.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2F0A.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 fb2ee1350dfac5863c8384617693ab82babc38f7c0da764a60fdef3083ee5b44
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a3285.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3285.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 9b1f0abe05843ad114279647df0e2b6e3d4d49fad08055691cd2ed76615982cd
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a3544.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3544.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 9d1e01a0b97cf282c2f3bb1c5521c62abf66e276d28a00d68046268194516d08
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a39F7.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a39F7.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 59492eb8c13a79f524a7834ad33a1079b18bf3c5f5dd10458f0ab6e579d3837b
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a3C68.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3C68.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 867bfca7f4c7898bde1a7d17c4c30abe01dc1d2b379b685792e33fc0fab89574
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a3F37.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3F37.bat
                                                                                                                                          • Size 776B
                                                                                                                                          • SHA256 0f2e20e98d9a7e55534a07bdd2c1f0774fa46b2c18ffff58741da78d07d6e6f5
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a47F.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a47F.bat
                                                                                                                                          • Size 775B
                                                                                                                                          • SHA256 892ec01d305d8ec54a1e9855a51ee3126d1f8d9dad09a94b0599d5f4833a086d
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$a7FA.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7FA.bat
                                                                                                                                          • Size 775B
                                                                                                                                          • SHA256 2fe79a97b14656613a6a08fe1a42a8bf388ae65a13cb9c4b5cfd1894b2144b8b
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$aAA9.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aAA9.bat
                                                                                                                                          • Size 775B
                                                                                                                                          • SHA256 a15067f1c69542e830d657784c86e52a38457ea2a18143348ac03f9b262866f1
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          $$aD59.bat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD59.bat
                                                                                                                                          • Size 775B
                                                                                                                                          • SHA256 b405f5f6e53b9727e5b2e463574b165e717d071854d601179c89a1684cba69dc
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.4MB
                                                                                                                                          • SHA256 60cb713c28f5c815d9123d4de93f93afa6d9dc67c4c0342050897301278b4bb8
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.2MB
                                                                                                                                          • SHA256 0540e767cb52305050ca95dc62a5985e85b890793d84e857bf9910da7a698e48
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.4MB
                                                                                                                                          • SHA256 1e6a507bba62e83e43607c29efd3939b3a2adc63f3b8e74d99f320163ca7c18d
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.3MB
                                                                                                                                          • SHA256 73664ab7d3f87899eccb1ea37a5596471109a6c8587e2615b0fd4547408a91e8
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.2MB
                                                                                                                                          • SHA256 c8f4a504f208aafd428da9ef6f6af8b709804c301a2c4ceda862d4fc11cb4f7d
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.3MB
                                                                                                                                          • SHA256 23b30e517bbbab861389395f0b6dab2545e95cc8a60b418fe237c2362aaba19e
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.3MB
                                                                                                                                          • SHA256 a4a9e1f2877bedfe18e84a3c6e3e8d37d549cdfefa700a89f8303eb88bd31052
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.2MB
                                                                                                                                          • SHA256 2561cbcf44b7156e9a89f7f0e4ac33a7cd19c96f46d32e4ab7cb6d0a7b832e0a
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.2MB
                                                                                                                                          • SHA256 8cdca9edbfdfd5347781e9dd27be25ef441dbb58ee67434e4e238b971d4b5f14
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.1MB
                                                                                                                                          • SHA256 867fb22300344486d331e05449e8fc55f3948e27d1cb744daa91028f040f98c4
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.1MB
                                                                                                                                          • SHA256 cd58cb4318ffb8b84dbd538edb2568ff9a8a0e782d0a5b09b99170078a3d4532
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.1MB
                                                                                                                                          • SHA256 0fdc511ab7fc024b7bbf73ac94a3ad1dd692cebe4a3841ca68a1b6da7919a2b0
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.0MB
                                                                                                                                          • SHA256 373b6eeab17782e61bb1d005f91cf8a81239b323b83194f909ba4f3f30989de9
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.0MB
                                                                                                                                          • SHA256 270bc873bceff033ba1f15b87386ae85b0ca189d774149059ee2cdb16288e016
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.0MB
                                                                                                                                          • SHA256 a844025639ad8eb7f0d1e210946acd592acea9b2bccc5b531cc97fb3e10fb699
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 3.9MB
                                                                                                                                          • SHA256 31d3200c217bbb6ca9f210122eb3f1a7cad6dd09674d42d728470af61d653120
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.5MB
                                                                                                                                          • SHA256 05304e5fbbd52577b37efd25eefe8dab08bf53ba5d9892ec3be9d406ab44fee2
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.5MB
                                                                                                                                          • SHA256 65e94dcb9a6743e94e4a275725fc33f5de8b6c70b5a30596eee2bdf3c9bd1fd7
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.5MB
                                                                                                                                          • SHA256 ff8bd3184a20ae3ccfad456bfb32f8910ba61a88b013e2663d44e9378831f9b0
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                          • Size 4.4MB
                                                                                                                                          • SHA256 676227df4eeee2053ef46dffc0cc3ed6f86de93c03311a1acb75419b68fcd651
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Logo1_.exe
                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                          • Size 32KB
                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          _desktop.ini
                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-2937465464-4167303362-2236413517-1000\_desktop.ini
                                                                                                                                          • Size 9B
                                                                                                                                          • SHA256 137a2336786405721f3ba28870250af8000e5ef527196716325fc80bf1dfe2f9
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          memory/432-10449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/628-10254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/648-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/696-152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/720-10369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/888-10142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/940-3572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/944-237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1012-10429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1016-10460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1112-10264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1252-5639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1280-5659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1284-2019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1348-10455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1432-10122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1464-6207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1608-10319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1700-10439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1704-6187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1712-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1716-10339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1820-10444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1832-10480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1856-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1876-10349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1924-10399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/1940-10146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2008-2899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2060-10284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2068-6223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2072-10419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2128-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2128-2166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2128-5959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2128-196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2140-10259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2184-10249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2216-6183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2228-10219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2284-2370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2292-5369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2336-10384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2372-28-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2400-10150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2408-5651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2412-5655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2452-3443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2508-10505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2520-6175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2552-10279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2560-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2604-10274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2760-10409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2764-10234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2784-10500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2840-10374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2844-6026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2852-5218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2864-10244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2932-10354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3008-10490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3024-10130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3028-5647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3100-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3108-10475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3168-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3204-5524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3228-1861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3268-10269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3284-10229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3296-5838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3324-1908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3352-10314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3360-10344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3480-10162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3504-2171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3540-8070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3612-10138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3676-7059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3716-10485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3736-10214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3756-10170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3780-10424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3784-10309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3796-10158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3824-2577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3836-10209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3848-10404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3856-10329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3860-10470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3888-10364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3924-10174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3944-10224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4036-10239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4040-10394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4052-10516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4052-10521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4100-10465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4116-6191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4128-10289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4180-6195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4204-10304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4212-10515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4240-10510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4256-19-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4288-10166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4344-6211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4372-10126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4400-10359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4512-10194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4544-10154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4572-6179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4588-3695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4592-10324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4596-67-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4640-5643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4644-10188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4648-10134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4708-10389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4716-10204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4740-6215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4764-10178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4784-6203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4788-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4788-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4828-10199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4832-10334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4848-10414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4932-6219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5020-10294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5024-10434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5036-10379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5044-10495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5084-10183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5104-10299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                          Download