Overview

overview

7

Static

static

3

2026-08-14...op.exe

windows10-2004-x64

7

2026-08-14...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
  • Size 4.6MB
  • Sample260814-e88mysvwcy
  • SHA256 9c9c7fce5701bde6412db24b201a2c5cd32239e270752b00cc281f565c024a62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F05.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6068
      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA260.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3308
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4D1.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3868
              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1852
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA733.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4468
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1020
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9B3.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4188
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3960
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF6.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2536
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4092
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE95.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2568
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:4304
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB106.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3820
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2184
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB443.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1252
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3408
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3240
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:676
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB982.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4072
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:1224
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCBE.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:616
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4108
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1296
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:6016
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4276
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:948
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC74E.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4620
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5524
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA99.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5920
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2716
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDD5.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5588
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3148
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD095.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4512
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2512
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD383.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2468
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4824
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD73C.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4288
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5424
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3800
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4448
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD95F.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5472
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4408
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA39.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3008
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3292
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB33.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4080
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3680
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC1E.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4808
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2080
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4592
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2584
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDA4.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3180
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3084
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE50.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1068
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2044
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF0C.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1772
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:3852
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFB8.bat
                                                                                                                          60⤵
                                                                                                                            PID:1528
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4832
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE073.bat
                                                                                                                                62⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2824
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:5692
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE11F.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:752
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:252
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1DA.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1248
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4284
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE296.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:1464
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:4788
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE361.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4492
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:5908
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46B.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:696
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4228
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6CC.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4936
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3004
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7C6.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3376
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:2648
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8B0.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                    PID:2280
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:5952
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9AA.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                          PID:1060
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:5260
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAB4.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:2704
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2672
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC79.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:1752
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3672
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED92.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                          PID:4688
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:3224
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9C.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1308
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF003.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                    PID:3000
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF11D.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:5160
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:2412
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF226.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                              PID:5680
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34F.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:4300
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:2876
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF468.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5A1.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:5740
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:5360
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6BA.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:3424
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:3372
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7F3.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:3736
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8DD.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:3032
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA44.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                              PID:3768
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1864
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB3E.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:4984
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:6092
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCD5.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:4640
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDA0.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                            PID:972
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE3C.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:3332
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFED8.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF65.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:248
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:436
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:2472
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12A.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B7.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:4396
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a243.bat
                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:5464
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3384
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E0.bat
                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                  PID:5492
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                      PID:3300
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37C.bat
                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:2092
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                            PID:1552
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a418.bat
                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                PID:900
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a502.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                          PID:5380
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DD.bat
                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                  PID:2320
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A8.bat
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a793.bat
                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:2288
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:1780
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87D.bat
                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1032
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a939.bat
                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:5808
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:5460
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA13.bat
                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3684
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1D.bat
                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:4244
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5576
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE8.bat
                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:3640
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD11.bat
                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2872
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDC.bat
                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:244
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA7.bat
                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2688
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF82.bat
                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a108C.bat
                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:480
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1147.bat
                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1203.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a131C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1416.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:236
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1687.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1790.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a185C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1907.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1ABD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a205A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2116.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a229D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2377.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a250E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a278E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a283A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2915.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DC8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3029.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a326B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3308.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a345F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a353A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5724
                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                    PID:1600
                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                      PID:4152
                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:1076
                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                PID:5440
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                  3⤵
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:3092
                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1636

                                                                                                                                              Network

                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                    Replay Monitor

                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                    Downloads

                                                                                                                                                    $$a9F05.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a9F05.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 96eb017dc1e97c111147107fe9aa4d0cd83ac301a90052e7b62e0f777145c2b0
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aA260.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA260.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 b805f762bcae201ae803cb564b12ebc1fe349cc7aff1b938a34edee876341d6c
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aA4D1.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA4D1.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 135dde1e95405726b6ae0cb7cc3bf7c42fd0e1a2a2b57cb3c608520bb6f1e2a7
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aA733.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA733.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 a01110847b583c81ce240c14abd9366071f6356e495478bb634b9a4064220cc8
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aA9B3.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA9B3.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 eedbde93d6206bc52d0a23833e021f056bb2d2944d042da4054617c6199c0652
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aABF6.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aABF6.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 513d04a4c6d97add7b4d13e745ec7dc1ebf6187207d8c1aef0c34f7154ad7904
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aAE95.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aAE95.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 5cee03e756b284275627131e42bdc1192de801b00f6ac5707784768d352d7177
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aB106.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB106.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 91f23fd6913511894126bb3d6aae4a3712a954b4f4750783b082c40e05f681f7
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aB443.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB443.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 32d21894063a00461cd562c87ecfef583ec97d564e2eb0c17ce2dba722a7c228
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aB6C3.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 f938a0ffd10cdcd39b312fcdb141a415378d3a5d21697aadf83a85e5ea64a221
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aB982.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB982.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 8b9691b28ce5086569bf490e6e7b46c50333e056d15b9b34a0e8a9a4c2074580
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aBCBE.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBCBE.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 3f0a895dd5aa0866c21a93f7d4d5a0d35cd548141255dba900babc9e0ebace68
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aBFCC.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 92ee9a7f361e66fd9f3a623f16c6b16bcaf3a8bb5f9f3a4beceda718efa6609e
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aC3B4.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 1e0e0b27fe24343ddd9aa36f853fe01093f15a2966386a5be2afb5a7a30a3e3c
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aC74E.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC74E.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 95874ff8bcaf88b48ee3d430efebd53efcaf180f06e4568bfbc0aa8b3d242e47
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aCA99.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCA99.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 9718bcc74b1c7c6e7fb8742e677c388c736710943f96c2a39cda87660aacb360
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aCDD5.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCDD5.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 e2ecec5f49af2ab084ad08d6a38c0f675f9af7038af4e8fd71a07db0b6e538fe
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    $$aD095.bat
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD095.bat
                                                                                                                                                    • Size 776B
                                                                                                                                                    • SHA256 9e8a9d9c2a7c30948678b8f24fd42073bf704c867d84c4807f1b8565cb734319
                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.5MB
                                                                                                                                                    • SHA256 05304e5fbbd52577b37efd25eefe8dab08bf53ba5d9892ec3be9d406ab44fee2
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.5MB
                                                                                                                                                    • SHA256 ff8bd3184a20ae3ccfad456bfb32f8910ba61a88b013e2663d44e9378831f9b0
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.4MB
                                                                                                                                                    • SHA256 676227df4eeee2053ef46dffc0cc3ed6f86de93c03311a1acb75419b68fcd651
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.5MB
                                                                                                                                                    • SHA256 65e94dcb9a6743e94e4a275725fc33f5de8b6c70b5a30596eee2bdf3c9bd1fd7
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.4MB
                                                                                                                                                    • SHA256 1e6a507bba62e83e43607c29efd3939b3a2adc63f3b8e74d99f320163ca7c18d
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.4MB
                                                                                                                                                    • SHA256 60cb713c28f5c815d9123d4de93f93afa6d9dc67c4c0342050897301278b4bb8
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.1MB
                                                                                                                                                    • SHA256 0fdc511ab7fc024b7bbf73ac94a3ad1dd692cebe4a3841ca68a1b6da7919a2b0
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.3MB
                                                                                                                                                    • SHA256 23b30e517bbbab861389395f0b6dab2545e95cc8a60b418fe237c2362aaba19e
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.3MB
                                                                                                                                                    • SHA256 73664ab7d3f87899eccb1ea37a5596471109a6c8587e2615b0fd4547408a91e8
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.0MB
                                                                                                                                                    • SHA256 270bc873bceff033ba1f15b87386ae85b0ca189d774149059ee2cdb16288e016
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.2MB
                                                                                                                                                    • SHA256 0540e767cb52305050ca95dc62a5985e85b890793d84e857bf9910da7a698e48
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.3MB
                                                                                                                                                    • SHA256 a4a9e1f2877bedfe18e84a3c6e3e8d37d549cdfefa700a89f8303eb88bd31052
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.2MB
                                                                                                                                                    • SHA256 c8f4a504f208aafd428da9ef6f6af8b709804c301a2c4ceda862d4fc11cb4f7d
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.2MB
                                                                                                                                                    • SHA256 2561cbcf44b7156e9a89f7f0e4ac33a7cd19c96f46d32e4ab7cb6d0a7b832e0a
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.1MB
                                                                                                                                                    • SHA256 867fb22300344486d331e05449e8fc55f3948e27d1cb744daa91028f040f98c4
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.2MB
                                                                                                                                                    • SHA256 8cdca9edbfdfd5347781e9dd27be25ef441dbb58ee67434e4e238b971d4b5f14
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.1MB
                                                                                                                                                    • SHA256 cd58cb4318ffb8b84dbd538edb2568ff9a8a0e782d0a5b09b99170078a3d4532
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-08-14_441f8b0c94a22013e42743dde18b74bc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                    • Size 4.0MB
                                                                                                                                                    • SHA256 373b6eeab17782e61bb1d005f91cf8a81239b323b83194f909ba4f3f30989de9
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    Dll.dll
                                                                                                                                                    • Path C:\Windows\Dll.dll
                                                                                                                                                    • Size 68KB
                                                                                                                                                    • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    Logo1_.exe
                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                    • Size 32KB
                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                    Submit Download

                                                                                                                                                    _desktop.ini
                                                                                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\_desktop.ini
                                                                                                                                                    • Size 9B
                                                                                                                                                    • SHA256 137a2336786405721f3ba28870250af8000e5ef527196716325fc80bf1dfe2f9
                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                    Submit Download

                                                                                                                                                    memory/248-404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/252-263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/428-621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/480-530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/676-111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/948-154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1020-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1032-476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1084-687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1224-119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1312-729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1364-555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1376-741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1420-446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1480-536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1520-394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1552-440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1600-213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1600-304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1700-765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1704-329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1724-339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1780-470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1852-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/1864-374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2044-243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2080-228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2096-597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2184-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2320-458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2372-399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2376-591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2412-334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2472-409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2512-192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2576-524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2584-233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2648-293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2672-309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2716-174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2864-669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2872-506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2876-344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2972-645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2984-573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/2988-419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3004-288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3032-369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3084-238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3148-178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3148-184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3160-549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3224-319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3292-218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3300-434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3308-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3372-359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3384-429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3408-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3496-627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3508-675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3552-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3552-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3640-500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3652-543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3672-314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3676-518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3680-223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3684-488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3736-364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3756-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3852-248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3928-349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3960-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3964-808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/3964-814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4092-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4104-384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4108-127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4124-464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4160-735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4164-717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4228-283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4284-268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4304-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4312-567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4324-783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4348-699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4396-424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4408-212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4448-207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4460-723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4544-747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4668-807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4788-273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4824-197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4832-253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4860-759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4872-389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4880-771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4888-711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4904-414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/4976-324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5012-789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5044-651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5084-657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5112-753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5128-639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5140-561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5156-663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5220-693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5260-303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5360-354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5380-452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5416-705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5424-202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5440-106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5440-130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5440-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5460-482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5524-166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5536-609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5576-494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5620-777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5692-258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5700-585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5720-801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5776-579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5832-603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5904-633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5908-278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5952-298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5960-615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/5968-512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/6016-143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/6064-795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/6072-681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download

                                                                                                                                                    memory/6092-379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                    Download